MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0b39a4fbccfbe395762a7c497dd64cea9236fb1c156075f290131c2531c53deb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 11


Intelligence 11 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0b39a4fbccfbe395762a7c497dd64cea9236fb1c156075f290131c2531c53deb
SHA3-384 hash: b2166d184f5993ae4a4dd7ddae3575df7a26d9215b81774a6b2b3e686eabd9756f7654730f6b8402ed2f835dd90364bd
SHA1 hash: 43587179f75107e305c3cd06aa0630c8b642feb4
MD5 hash: f5f6739d2197da204c48865971147d50
humanhash: connecticut-indigo-pluto-neptune
File name:REM0000007.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:194'503 bytes
First seen:2021-02-23 17:41:33 UTC
Last seen:2021-02-26 18:15:31 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ea4e67a31ace1a72683a99b80cf37830 (70 x Formbook, 64 x GuLoader, 54 x Loki)
ssdeep 3072:h1TxN62RDxPA1c2CdSSizl/Rb9kqlGJ7lJguv:h11QpsSSiB/V9kqCJg2
Threatray 1'662 similar samples on MalwareBazaar
TLSH DD14D6FF145481DACD2955786589E3BD8BE95C4904A3C70823EB76E8B738ACC449BFE0
Reporter GovCERT_CH
Tags:RemcosRAT

Intelligence

File Origin
# of uploads :
7
# of downloads :
116
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/118762/
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Creating a file in the %temp% directory
Creating a window
Creating a file
Creating a file in the %AppData% subdirectories
Unauthorized injection to a recently created process
Setting a keyboard event handler
Sending a UDP request
Sending a custom TCP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/615798
Signature
Contains functionality to capture and log keystrokes
Contains functionality to detect virtual machines (IN, VMware)
Contains functionality to inject code into remote processes
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Detected Remcos RAT
Detected unpacking (changes PE section rights)
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 356907 Sample: REM0000007.exe Startdate: 23/02/2021 Architecture: WINDOWS Score: 100 31 Malicious sample detected (through community Yara rule) 2->31 33 Multi AV Scanner detection for dropped file 2->33 35 Multi AV Scanner detection for submitted file 2->35 37 5 other signatures 2->37 6 REM0000007.exe 1 21 2->6         started        10 oxample.exe 17 2->10         started        process3 file4 19 C:\Users\user\AppData\Roaming\...\oxample.exe, PE32 6->19 dropped 21 C:\Users\user\AppData\Local\...\System.dll, PE32 6->21 dropped 39 Detected unpacking (changes PE section rights) 6->39 41 Contains functionality to detect virtual machines (IN, VMware) 6->41 43 Contains functionality to steal Chrome passwords or cookies 6->43 51 4 other signatures 6->51 12 REM0000007.exe 1 2 6->12         started        23 C:\Users\user\AppData\Local\...\f33a7yk.dll, PE32 10->23 dropped 25 C:\Users\user\AppData\Local\...\System.dll, PE32 10->25 dropped 45 Multi AV Scanner detection for dropped file 10->45 47 Machine Learning detection for dropped file 10->47 49 Contains functionality to capture and log keystrokes 10->49 17 oxample.exe 10->17         started        signatures5 process6 dnsIp7 29 162.218.211.157, 49727, 49735, 49739 ASN-QUADRANET-GLOBALUS United States 12->29 27 C:\Users\user\AppData\Roaming\...\logs.dat, ASCII 12->27 dropped 53 Installs a global keyboard hook 12->53 file8 signatures9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0b39a4fbccfbe395762a7c497dd64cea9236fb1c156075f290131c2531c53deb/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2021-02-23 14:24:20 UTC
AV detection:
15 of 46 (32.61%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bm42j66m7przk5rkprex3vsm5kjdn6y4cvqhl4uqcmockmofhxvq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
04e18fc32464a616b096a50a3ed43b646ece444e693b238a29d6f6de6ee45833
RemcosRAT
0ef4ceb36c6bc5067390aa323ea7908be59da236315e41d0857d3426cfcc2ce1
RemcosRAT
1619a67b0219aac78f1e5e8ac86ec2cf68641ba65a19653fc176916275b6f6ad
RemcosRAT
19c85373616be5338b379799fa36c19e4ff5d5e7f67fa820ea9040ab5427d516
RemcosRAT
210560d23e3c023c90bd24ed0d76c68732dc267277fc6adcc3c991cb611bb06a
RemcosRAT
22e473a7adb1bf3da0d6b900d5ec9f1b4a455bde122d31d6509b8d7b5bd9eab1
RemcosRAT
292fdda313c6d03852ecd9487653eb15bdf8cf6412e814365c2f176a1104cbc3
RemcosRAT
9d692165cbb8d2a181769b723e7300b02f534fec4563d4bd155b4c293d6ebe72
RemcosRAT
a81dc80c4e292405023f9c59504e55045ca754901cd06185d041642ce91a33b2
RemcosRAT
ab64843d1074c1091118c175f2ca85e43d66a7918faf479be9d6d2613583fce3
RemcosRAT
+ 1'652 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos persistence rat
Link:
https://tria.ge/reports/210223-lq2bljp196/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Remcos
Unpacked files
SH256 hash:
2a57265d2180285f67b9404c84b336be0950b064217bbd2702eb38f379740fa8
MD5 hash:
30098e175633b3a0389c742fb316017d
SHA1 hash:
3aa6f91e11c119153a41dad957908a9e74099f86
Link:
https://www.unpac.me/results/3f7ae572-573b-41d9-a173-9d419e3d273e/
SH256 hash:
3b470ba8644651bf4856262bc8a6e5761a90d1c840d27d1a2f2a3ce3370d42d4
MD5 hash:
1998ae995726d5f82e54a2d131c28d90
SHA1 hash:
df12700765b351ac7e5dfab453de634a7c8f1b2b
Detections:
win_buer_auto
Create hunting rule
Link:
https://www.unpac.me/results/3f7ae572-573b-41d9-a173-9d419e3d273e/
SH256 hash:
76b72d36913c9ccddc44437ff25c9f3d1c3b8c83a75cee8c76e02ddaaf34d740
MD5 hash:
faa761af25480d1915daebfcd4ff6f34
SHA1 hash:
bd42e06ab087387a300e3722dcec5af1850284c3
Detections:
win_remcos_g0
Create hunting rule
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/3f7ae572-573b-41d9-a173-9d419e3d273e/
SH256 hash:
f578aa2f6b203655fe33165c8cd8c49fee0fb905e16b135083f7edf132e94743
MD5 hash:
2ef267e236a375e035b3059860b2d962
SHA1 hash:
c421fa8b9537e14faf533ee1fcd85bd5e19d599a
Link:
https://www.unpac.me/results/3f7ae572-573b-41d9-a173-9d419e3d273e/
SH256 hash:
0b39a4fbccfbe395762a7c497dd64cea9236fb1c156075f290131c2531c53deb
MD5 hash:
f5f6739d2197da204c48865971147d50
SHA1 hash:
43587179f75107e305c3cd06aa0630c8b642feb4
Link:
https://www.unpac.me/results/3f7ae572-573b-41d9-a173-9d419e3d273e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0b39a4fbccfbe395762a7c497dd64cea9236fb1c156075f290131c2531c53deb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Chrome_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Chrome in files like avemaria
Rule name:INDICATOR_EXE_Packed_MPress
Create hunting rule
Author:ditekSHen
Description:Detects executables built or packed with MPress PE compressor
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:Remcos
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Remcos in memory
Rule name:remcos_rat
Create hunting rule
Author:jeFF0Falltrades
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip 2b3437e9b7960e510a1a49d031f4171edcbf2fbbf6e4684637b8c2c67d3af2a3

RemcosRAT

Executable exe 0b39a4fbccfbe395762a7c497dd64cea9236fb1c156075f290131c2531c53deb

(this sample)

  
Dropped by
MD5 75886a56ce2be0863567a5e49745cb6e
  
Dropped by
SHA256 2b3437e9b7960e510a1a49d031f4171edcbf2fbbf6e4684637b8c2c67d3af2a3
  
Dropped by
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/118762/

Comments