MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1d510653c1ea9f9a519c53d92067ab27ee434f8e5c34b980f6a236f4e02dba22. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	1d510653c1ea9f9a519c53d92067ab27ee434f8e5c34b980f6a236f4e02dba22
SHA3-384 hash:	6b93f0c988b06eee365c8b862a415a6c9a6992972e2b25442c0ac3e03379c9489112be88cb1345407261bbaa24b9bedb
SHA1 hash:	7ed5e5836830cd8915a9611f60ae3fea26f9d4a5
MD5 hash:	9c372c5be2c94e706ffdf1b1e0dea0ba
humanhash:	earth-mirror-eleven-seventeen
File name:	SWIFT.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	253'440 bytes
First seen:	2020-07-15 09:54:59 UTC
Last seen:	2020-07-15 12:43:46 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	6144:xIsRvoHwh8AsXqw22vhMIt82Za1bWGctdveQe4U:g2VItNZa1bW9tdvy
Threatray	876 similar samples on MalwareBazaar
TLSH	8C44CF51B7FC5B02F17987F446A154C807BA369A6562EB1D0CC5F4DB267BB088BA0F23
Reporter	JAMESWT_WT
Tags:	RemcosRAT

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Remcos

Link:

https://www.capesandbox.com/analysis/25960/

Detection(s):

SecuriteInfo.com.Trojan.DownLoader33.59431.26573.17874.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

DNS request

Creating a file in the %AppData% subdirectories

Setting a global event handler for the keyboard

Sending a TCP request to an infection source

Detection:

remcos

Link:

https://mwdb.cert.pl/sample/1d510653c1ea9f9a519c53d92067ab27ee434f8e5c34b980f6a236f4e02dba22/

Threat name:

ByteCode-MSIL.Trojan.Dapato

Status:

Malicious

First seen:

2020-07-15 09:55:30 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=dviqmu6b5kpzuum4kpmsaz5le7xegt4olq2ltahwui3pjybnxira._file

Verdict:

malicious

Label(s):

remcos

RemcosRAT

13eaaf168207a5014c105532b6a23805fc6db28f73908914a4583979173cc254

RemcosRAT

356c197426a3bdabccf7b10ece0a425571b55bbeb7e09e3121b6ff6b7c2e253a

RemcosRAT

397545efcbf53bebabdb003bbe9f8b619b7ffdd5383c21ecd9e99c6de3e3cd83

RemcosRAT

5106eff2035cae4bc844f175750857ecffe095b70f7872ddd212bedce7776e80

RemcosRAT

611a1ab90193672c4b95cb934a617b98314df0a24406342a0f1fedb08efd1997

RemcosRAT

8c59bc29addb6c7cd78946b0f449b39ba663b0311d80c1a55b54742e7facb8af

RemcosRAT

b101b46c4af2b0bf121699278385567d8acf726dc94d85d304d86f48312065d2

RemcosRAT

c8c1e04edd5c422d065e27a3a73931d373de200419cd9ba649fdfadee686e5f2

RemcosRAT

d69aa1932b2e702e5065ee19da9fc9cf2b05e7dbaa617141b14eaa501a14955e

RemcosRAT

+ 866 additional samples on MalwareBazaar

Result

Malware family:

remcos

Score:

10/10

Tags:

rat family:remcos

Link:

https://tria.ge/reports/200715-md68wk13sn/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of SetThreadContext

Remcos

Malware Config

C2 Extraction:

muchogroup.ddns.net:5050

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_RemcosRAT Create hunting rule
Author:	abuse.ch

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator