MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 1c517ddebb6f5893d52918c51a70e56f68b50dd65e0460a673cce3625a0f8a2b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RemcosRAT
Vendor detections: 7
| SHA256 hash: | 1c517ddebb6f5893d52918c51a70e56f68b50dd65e0460a673cce3625a0f8a2b |
|---|---|
| SHA3-384 hash: | 1e84f249462ef876e4fd67e8ff9f6ee9bc157f5c3625f5fdd5840f96b62ed60ba107fd098cae383ad5f57721afa35bca |
| SHA1 hash: | 3087de7ea04b0ab83eb2f278923828a45a0823c1 |
| MD5 hash: | 7704dc911d420896f07e21986aa85746 |
| humanhash: | washington-september-nevada-skylark |
| File name: | New purchase order PO#78904301541,pdf.exe |
| Download: | download sample |
| Signature | RemcosRAT |
| File size: | 651'264 bytes |
| First seen: | 2020-08-19 09:23:37 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 1d3807efc70a0a5a6d2ab497250e9cb5 (4 x RemcosRAT, 1 x AZORult, 1 x AveMariaRAT) |
| ssdeep | 12288:Wm/ZNPa2c/PWwuUDKcoEwWLC2W2nKjdkOdqY55w/sPXjlBeh07D:Wm/TyzPWwuUDpoEwECcKpkON/vno0 |
| Threatray | 924 similar samples on MalwareBazaar |
| TLSH | 79D49E62E6804837C1631578AC0B9FE9D937AF103B98AC476BF62E0C5F397D17929097 |
| Reporter |  abuse_ch |
| Tags: | exe RemcosRAT |
abuse_ch
Malspam distributing unidentified malware:HELO: cloudhost-107411.us-midwest-1.nxcli.net
Sending IP: 209.126.25.153
From: AEV Ltd <aev@aev.co.uk>
Subject: order inquiry
Attachment: New purchase order PO78904301541,pdf.iso (contains "New purchase order PO#78904301541,pdf.exe")
Intelligence
File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a UDP request
DNS request
Sending a custom TCP request
Creating a file
Launching a process
Setting a single autorun event
Unauthorized injection to a recently created process
Connection attempt to an infection source
Result
Threat name:
Remcos
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Signature
Allocates memory in foreign processes
Contains functionality to capture and log keystrokes
Contains functionality to inject code into remote processes
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Creates a thread in another existing process (thread injection)
Detected Remcos RAT
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Sigma detected: Remcos
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Ymacco
Status:
Malicious
First seen:
2020-08-18 09:31:05 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
remcos
Similar samples:
+ 914 additional samples on MalwareBazaar
Result
Malware family:
remcos
Score:
10/10
Tags:
persistence rat family:remcos
Behaviour
Modifies system certificate store
Suspicious use of WriteProcessMemory
Adds Run key to start application
Remcos
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.