MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1932f1f1776135afa8bfe256331b1ca540883518fbd2e36d73a937a6faba3cb3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1932f1f1776135afa8bfe256331b1ca540883518fbd2e36d73a937a6faba3cb3
SHA3-384 hash: 4cd303d282c5756e0400e0ec36ccd9543129557f711721c7f788ed56505d6817832acae6f7ef75d2d76c83289798e421
SHA1 hash: 5fe9f9bd6c9d75ff6914e6b165213643605fa080
MD5 hash: 83d15eedcf1946a704ed9bf7917917cb
humanhash: oregon-delta-fanta-mars
File name:1932f1f1776135afa8bfe256331b1ca540883518fbd2e36d73a937a6faba3cb3
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'336'840 bytes
First seen:2020-06-29 07:16:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash afcdf79be1557326c854b6e20cb900a7 (1'102 x FormBook, 936 x AgentTesla, 399 x RemcosRAT)
ssdeep 24576:KAHnh+eWsN3skA4RV1Hom2KXFmIadbBV7SOe5R:dh+ZkldoPK1XadtV+XR
Threatray 1'402 similar samples on MalwareBazaar
TLSH E5557C03739D9026FEAA927F5B55B20156BD7D2400E3872F12983D6DA9F03B11E3DE62
Reporter JAMESWT_WT
Tags:RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/15509/
Detection(s):
Win.Malware.Nymeria-6988663-0
Create hunting rule

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/1932f1f1776135afa8bfe256331b1ca540883518fbd2e36d73a937a6faba3cb3/
Threat name:
Win32.Trojan.SAgent
Create hunting rule
Status:
Malicious
First seen:
2020-06-21 00:58:56 UTC
File Type:
PE (Exe)
Extracted files:
22
AV detection:
29 of 31 (93.55%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dezpd4lxme227kf74jldggy4uvaiqniy7pjog3ltve32n6v2hszq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
0b82d3d29091a908e27761d0869fcf5b77a66bb7c7f3975eec0565af0bf990af
RemcosRAT
0d33703c143c103f34b66b1dbf0d6f351e1d9880aba1bf8550eb3f138d89d3d5
RemcosRAT
15f9d27a0258882f9bec928b896ad7cdeda9fb3d709a1a474c698bccedabf26a
RemcosRAT
22190205eebc2b1ae37fbb904b956c138ccb1cfda28132a3107fe34dc5aff2c2
RemcosRAT
43e3b82e88816ea1e7151d682956fecae812574d47c4c29f820f6a41d6595376
RemcosRAT
5bddffdbdadb3f5d1f08cb87b5227b914d7e844b2fb3b626d1fa42dda37f182d
RemcosRAT
5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c
RemcosRAT
aeaf83e513f357bf42bfe176f3706029604e3012b92a57fe4e7c83f5450175d9
RemcosRAT
c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b
RemcosRAT
f5e9c92a15746fdf49171ed78dbea3250cefe1beeffe6c6f706d8241d3f60739
RemcosRAT
+ 1'392 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/200629-7w3sczssta/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetThreadContext
Drops startup file
UPX packed file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/15509/

Comments