MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0d33703c143c103f34b66b1dbf0d6f351e1d9880aba1bf8550eb3f138d89d3d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0d33703c143c103f34b66b1dbf0d6f351e1d9880aba1bf8550eb3f138d89d3d5
SHA3-384 hash: ffce4e88db0c97b92776b2024b8bc768fa315303c0c4066b970f4076630ea149717233742c51e2b109851578a4e3a92e
SHA1 hash: 63a88ea838ccef8f2790b7f1a8ed2acd35064a0a
MD5 hash: 855e7a5364aac0ce4fb6dee4838857c6
humanhash: lake-burger-comet-muppet
File name:0d33703c143c103f34b66b1dbf0d6f351e1d9880aba1bf8550eb3f138d89d3d5
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'336'848 bytes
First seen:2020-06-10 07:36:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash afcdf79be1557326c854b6e20cb900a7 (1'102 x FormBook, 936 x AgentTesla, 399 x RemcosRAT)
ssdeep 24576:KAHnh+eWsN3skA4RV1Hom2KXFmIadbBV7SOe5d:dh+ZkldoPK1XadtV+Xd
Threatray 1'402 similar samples on MalwareBazaar
TLSH 96557C03739D9026FEAA927F5B55B20156BD7D2400E3872F12983D6DA9F03B11E3DE62
Reporter JAMESWT_WT
Tags:RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Nymeria-6988663-0
Create hunting rule

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.SAgent
Create hunting rule
Status:
Malicious
First seen:
2020-06-05 21:16:00 UTC
File Type:
PE (Exe)
Extracted files:
22
AV detection:
30 of 31 (96.77%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
0b82d3d29091a908e27761d0869fcf5b77a66bb7c7f3975eec0565af0bf990af
RemcosRAT
15f9d27a0258882f9bec928b896ad7cdeda9fb3d709a1a474c698bccedabf26a
RemcosRAT
1932f1f1776135afa8bfe256331b1ca540883518fbd2e36d73a937a6faba3cb3
RemcosRAT
22190205eebc2b1ae37fbb904b956c138ccb1cfda28132a3107fe34dc5aff2c2
RemcosRAT
43e3b82e88816ea1e7151d682956fecae812574d47c4c29f820f6a41d6595376
RemcosRAT
5bddffdbdadb3f5d1f08cb87b5227b914d7e844b2fb3b626d1fa42dda37f182d
RemcosRAT
5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c
RemcosRAT
aeaf83e513f357bf42bfe176f3706029604e3012b92a57fe4e7c83f5450175d9
RemcosRAT
c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b
RemcosRAT
f5e9c92a15746fdf49171ed78dbea3250cefe1beeffe6c6f706d8241d3f60739
RemcosRAT
+ 1'392 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-w9lz3pv34s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Drops startup file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments