MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a7e2e56ddf654151b898a8c0a1c0b9d18a6c29a05fbb7f75df72fc7c4cea175. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	0a7e2e56ddf654151b898a8c0a1c0b9d18a6c29a05fbb7f75df72fc7c4cea175
SHA3-384 hash:	a5651a391db4b4a8614afdd1c74013091aea1aa9c4fed17b851b95ff6cf81d681c0b39638b8cfab6242eb2edabdbc69d
SHA1 hash:	ee1f16dfc1cf358507767d92db164d25caaa49c2
MD5 hash:	e0fa9b6a05c0d441088dd36f168fef58
humanhash:	iowa-berlin-hamper-nineteen
File name:	Corona Updates.xls
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	50'344 bytes
First seen:	2020-08-15 17:09:30 UTC
Last seen:	2020-08-15 17:54:02 UTC
File type:	xlsx
MIME type:	application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
ssdeep	1536:KIQYAAMoo4Ww/mcSZc1VB6XdFLbDLiIuN8P:c1oT/mcGc1VojLbDLwNi
TLSH	C033F1994AB4C137E46BECB9C10A54E690448EC60E5345302ED8B3FA36C2DD76E1E79A
Reporter	abuse_ch
Tags:	COVID-19 RAT RemcosRAT xls

abuse_ch

Malspam distributing RemcosRAT:

HELO: lancar.cloudhost.id
Sending IP: 103.134.152.236
From: TWJTUBA <CMI@mail.ru>
Subject: Virus Updates
Attachment: Corona Updates.xls

RemcosRAT payload URL:
https://ccleaner.tech/ccsetup120.exe

RemcosRAT C2s:
62.102.148.130:2966
185.156.175.43:2966
95.217.204.230:2401

Intelligence

File Origin

# of uploads :

# of downloads :

112

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.43666101.23318.5320.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

DNS request

Connection attempt

Launching a file downloaded from the Internet

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/432041

Signature

Document contains an embedded VBA with many string operations indicating source code obfuscation

Machine Learning detection for sample

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0a7e2e56ddf654151b898a8c0a1c0b9d18a6c29a05fbb7f75df72fc7c4cea175/

Threat name:

Script-Macro.Downloader.SLoad

Status:

Suspicious

First seen:

2020-08-14 22:50:06 UTC

AV detection:

12 of 48 (25.00%)

Threat level:

3/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=bj7c4vw56zkbkg4jrkgauhaltumknqu2ax53p52564x4prgouf2q._file

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/200815-s4vcz3lp32/

Behaviour

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0a7e2e56ddf654151b898a8c0a1c0b9d18a6c29a05fbb7f75df72fc7c4cea175

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.