MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 126b33c2868dde525221c47721ba9860b9c172d7c8ab74238a8d3f28f04bbb68. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 11

Intelligence 11 IOCs YARA 9 File information Comments

SHA256 hash:	126b33c2868dde525221c47721ba9860b9c172d7c8ab74238a8d3f28f04bbb68
SHA3-384 hash:	bd48ed0011ed30d528793601d384ce3c5e31dcfac13ffa3f9eacf8ea0abfd490a8e88effb71b7c8177f1559123c4f870
SHA1 hash:	03f125c9939e3f471ef59d265db15c98b47b8878
MD5 hash:	69d02b16a392d582b03f85c1a63ab659
humanhash:	avocado-oklahoma-utah-leopard
File name:	turkeybank00600.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	124'671 bytes
First seen:	2021-03-03 21:53:32 UTC
Last seen:	2021-03-10 02:06:30 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	b76363e9cb88bf9390860da8e50999d2 (464 x Formbook, 184 x AgentTesla, 122 x SnakeKeylogger)
ssdeep	3072:dJ2S2L6KbqDCwcpbTIQxM4WuNombIPwQmgrk3JS2:d8LxBxKvyOqS2
TLSH	D3C3E182F39184FAF89306B0053BAE65F77BDE18A4D229472B9C7F7706B31839946147
Reporter	GovCERT_CH
Tags:	RemcosRAT

Intelligence

File Origin

# of uploads :

# of downloads :

171

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

turkeybank00600.exe

Verdict:

Malicious activity

Analysis date:

2021-03-03 21:58:45 UTC

Tags:

trojan rat remcos

Link:

https://app.any.run/tasks/70343634-597d-425e-bafa-b8dd2b880f51

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Remcos

Link:

https://www.capesandbox.com/analysis/122121/

Detection(s):

PUA.Win.Downloader.Soft32downloader-6691270-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Unauthorized injection to a recently created process

Setting a keyboard event handler

Sending a custom TCP request

Creating a file in the %AppData% subdirectories

Sending a UDP request

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Remcos

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/626825

Signature

Contains functionality to capture and log keystrokes

Contains functionality to detect virtual machines (IN, VMware)

Contains functionality to inject code into remote processes

Contains functionality to register a low level keyboard hook

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Detected Remcos RAT

Detected unpacking (changes PE section rights)

Installs a global keyboard hook

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Remcos

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected Remcos RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/126b33c2868dde525221c47721ba9860b9c172d7c8ab74238a8d3f28f04bbb68/

Threat name:

Win32.Trojan.SpyNoon

Status:

Malicious

First seen:

2021-03-03 21:54:06 UTC

AV detection:

23 of 47 (48.94%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=cjvthqugrxpfeurbyr3sdouymc44c4wxzcvxii4kru7sr4clxnua._file

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos rat

Link:

https://tria.ge/reports/210303-168nr7jfqs/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Loads dropped DLL

Remcos

Unpacked files

SH256 hash:

2a57265d2180285f67b9404c84b336be0950b064217bbd2702eb38f379740fa8

MD5 hash:

30098e175633b3a0389c742fb316017d

SHA1 hash:

3aa6f91e11c119153a41dad957908a9e74099f86

Link:

https://www.unpac.me/results/4571f10a-61ad-4497-964e-664165bdbd39/

SH256 hash:

51e8b6f6e59496cbf19e1656b0d2605953211ed96ce3f97bdc9ccfc512204742

MD5 hash:

efd64134851d9eadc8a94f1aba999932

SHA1 hash:

bf1be56c22929fc044cda452b0ef10b24146c175

Link:

https://www.unpac.me/results/4571f10a-61ad-4497-964e-664165bdbd39/

SH256 hash:

fe2e6fd49be38646629c1d43619b0f52ec40fecaf53069d853d3231f28cd2c87

MD5 hash:

d4e7c986154e4838e8e8ebcf4d2b2549

SHA1 hash:

6ff988dfa1fee7ab0eb8dfed61d84d08e8e8a153

Detections:

win_remcos_g0

win_remcos_auto

Link:

https://www.unpac.me/results/4571f10a-61ad-4497-964e-664165bdbd39/

SH256 hash:

e1c1241b5f1e44ff2273d99cedc3c084b4d1a9f4d460e8b4cde541f92601f213

MD5 hash:

aeda52117c9f109ec8e8563dda55fd32

SHA1 hash:

e8ccb10929eb40df4abb66429ab8db2b5e281181

Link:

https://www.unpac.me/results/4571f10a-61ad-4497-964e-664165bdbd39/

SH256 hash:

126b33c2868dde525221c47721ba9860b9c172d7c8ab74238a8d3f28f04bbb68

MD5 hash:

69d02b16a392d582b03f85c1a63ab659

SHA1 hash:

03f125c9939e3f471ef59d265db15c98b47b8878

Link:

https://www.unpac.me/results/4571f10a-61ad-4497-964e-664165bdbd39/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/126b33c2868dde525221c47721ba9860b9c172d7c8ab74238a8d3f28f04bbb68

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Chrome_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Chrome in files like avemaria

Rule name:	INDICATOR_EXE_Packed_MPress Create hunting rule
Author:	ditekSHen
Description:	Detects executables built or packed with MPress PE compressor

Rule name:	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer Create hunting rule
Author:	ditekSHen
Description:	detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Rule name:	Keylog_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Contains Keylog

Rule name:	Remcos Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Remcos in memory

Rule name:	remcos_rat Create hunting rule
Author:	jeFF0Falltrades

Rule name:	REMCOS_RAT_variants Create hunting rule

Rule name:	suspicious_packer_section Create hunting rule
Author:	@j0sm1
Description:	The packer/protector section names/keywords
Reference:	http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator