MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 054fb3351a312daf5ab8011db57731961a0e7258eac118dada8e1f5ba531ba73. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	054fb3351a312daf5ab8011db57731961a0e7258eac118dada8e1f5ba531ba73
SHA3-384 hash:	93fa968b845658f79d92f8d4f93f33930baf922c5ebda494f4d7abf9cfc9a6b5e0c38f71b886953ee258791f5853aea0
SHA1 hash:	1a6f16b9ff57b4c3f752ac3eb9f0f5f31d39e424
MD5 hash:	42387bb41af3f8f11137d4d515d5f65e
humanhash:	ink-nine-sweet-fourteen
File name:	42387bb41af3f8f11137d4d515d5f65e.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	2'761'360 bytes
First seen:	2022-03-28 08:22:49 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	01d1b984e99e67b6f7ae46199d7dfd92 (12 x RemcosRAT)
ssdeep	49152:K9SRQo3DNrOKFcHxALBpIHo9HYdZvXYEj4UDEbVhqTig2Iug/xRNzi:KMRQo3DNry23M80F4WyhqTi5Iug/xRNO
TLSH	T1DCD5336C49FB29ADCD87A07185A6E533E2683ED8A9CC2D872DF63E37F4E5911D1C4840
File icon (PE):
dhash icon	c4d48eaa8ad4d4f8 (1'000 x RemcosRAT, 1 x Worm.Ramnit, 1 x Vjw0rm)
Reporter	abuse_ch
Tags:	exe RAT RemcosRAT

Intelligence

File Origin

# of uploads :

# of downloads :

262

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/258515/

Detection(s):

SecuriteInfo.com.Variant.Midie.109361.5050.1992.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

overlay packed shell32.dll

Link:

https://www.filescan.io/uploads/6241706b1f2042394840978c/reports/0e4c4f45-ac3e-42d8-913a-23cbe553f2dc/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/7f7a3777-7b6d-4eae-b7c4-08864c112f2e

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/965617

Signature

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

PE file contains section with special chars

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/054fb3351a312daf5ab8011db57731961a0e7258eac118dada8e1f5ba531ba73/

Threat name:

Win32.Trojan.Tnega

Status:

Malicious

First seen:

2022-03-28 11:11:46 UTC

AV detection:

19 of 41 (46.34%)

Threat level:

5/5

Result

Malware family:

n/a

Score:

7/10

Tags:

themida

Link:

https://tria.ge/reports/220328-j944dahbd9/

Unpacked files

SH256 hash:

054fb3351a312daf5ab8011db57731961a0e7258eac118dada8e1f5ba531ba73

MD5 hash:

42387bb41af3f8f11137d4d515d5f65e

SHA1 hash:

1a6f16b9ff57b4c3f752ac3eb9f0f5f31d39e424

Link:

https://www.unpac.me/results/97623c47-7213-4cfc-84d8-e6b20efa3c26/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.16

Link:

https://yomi.yoroi.company/submissions/054fb3351a312daf5ab8011db57731961a0e7258eac118dada8e1f5ba531ba73

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.