MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 06c707fd91ab2397dece6758cd55ff0d3a81b6f00afb5e7d9f1cb7fc6a16f0a8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 2

Intelligence 2 IOCs YARA File information Comments

SHA256 hash:	06c707fd91ab2397dece6758cd55ff0d3a81b6f00afb5e7d9f1cb7fc6a16f0a8
SHA3-384 hash:	211e6fde5ddfe9c075662d29dcc845488997f18eafb20fa13e6ca7dc9c89483a06d4073f061efff74a05d5976fe662c9
SHA1 hash:	8cb44f868a8343c612b76279abc394ab0882fba0
MD5 hash:	557536103d1520e7f67b7d9561aadbb2
humanhash:	quebec-finch-dakota-vermont
File name:	Revised-order-CYO-751.tar.lz
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	1'404 bytes
First seen:	2022-05-26 19:33:04 UTC
Last seen:	Never
File type:
MIME type:	application/x-lzip
ssdeep	24:KjBRZCkWGCoe9RsCuDRu/Q10Micn+lvZBtVkCVkdXiDX8Q4tRKiait588px9:KtRokbCJZuDc/QNjYRBtVkKaXmMxwTgB
TLSH	T190210BE1CB4D7055FD4C59B6A7CEC39A0591E055C4375B517312CA0DC70450C7A340EB
Reporter	c_APT_ure
Tags:	LZIP RAT remcos RemcosRAT

c_APT_ure

https://bazaar.abuse.ch/sample/15566d9a6c62e9e3bc4f84b77aa65abc1f3c11d1c6f9e9acf2f3dd3748c00f42

https://www.joesandbox.com/analysis/630103/0/html
Threatname: Remcos
{
"Version": "3.4.1 Pro",
"Host:Port:Password": "menz.ddns.net:45901:1",
"Assigned name": "MAY",
"Connect interval": "1",
"Install flag": "Disable",
"Setup HKCU\\Run": "Enable",
"Setup HKLM\\Run": "Disable",
"Install path": "AppData",
"Copy file": "vlc.exe",
"Startup value": "Remcos",
"Hide file": "Disable",
"Mutex": "chorne-VFQ2WR",
"Keylog flag": "1",
"Keylog path": "AppData",
"Keylog file": "logs.dat",
"Keylog crypt": "Enable",
"Hide keylog file": "Disable",
"Screenshot flag": "Disable",
"Screenshot time": "10",
"Take Screenshot option": "Disable",
"Take screenshot title": "notepad;solitaire;",
"Take screenshot time": "5",
"Screenshot path": "AppData",
"Screenshot file": "Screenshots",
"Screenshot crypt": "Disable",
"Mouse option": "Disable",
"Delete file": "Disable",
"Audio record time": "5",
"Audio path": "AppData",
"Audio folder": "MicRecords",
"Connect delay": "0",
"Copy folder": "vlc",
"Keylog folder": "remcos",
"Keylog file max size": "100000"
}