MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 20d6b4781904d93104efcdc760eb6809714c3eae777fd098840d54008d301f7f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	20d6b4781904d93104efcdc760eb6809714c3eae777fd098840d54008d301f7f
SHA3-384 hash:	50548306dc770a4d133d05b368975089932f2cd10b907f716fc7f3b2dc3c5477f7abeca0fc826e7f65fae8c2181b0593
SHA1 hash:	f7d15870d2565a64c800354c2a7292e94f9aa78d
MD5 hash:	02e54d58ef60f52a40e1dff3c5aa756d
humanhash:	south-asparagus-victor-ack
File name:	27-06-2023_ PDF_00233466115969388.zip
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	860'604 bytes
First seen:	2023-06-27 11:30:16 UTC
Last seen:	2023-06-27 11:31:41 UTC
File type:	zip
MIME type:	application/zip
ssdeep	24576:Dr25rv16TBdjmSyhIH+8MXjWPEinzRW0VWO+hR7gI:0ml48MXjwtWsW5d
TLSH	T1A305339A130FEFFAD2C612ECEE124D542CE21A0E08F5265A2653667C3F5324D1AD39F5
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	cocaman
Tags:	RemcosRAT zip

cocaman

Malicious email (T1566.001)
From: "=?UTF-8?B?U2Now7x0emUgRGFuaWVs?= <daniel.schuetze@yandex.com>" (likely spoofed)
Received: "from static.101.24.108.65.clients.your-server.de (static.101.24.108.65.clients.your-server.de [65.108.24.101]) "
Date: "27 Jun 2023 11:29:37 -0700"
Subject: "FW: Falsche IBAN"
Attachment: "27-06-2023_ PDF_00233466115969388.zip"

Intelligence

File Origin

# of uploads :

# of downloads :

117

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	27-06-2023_ PDF_00233466115969388.exe
File size:	874'246 bytes
SHA256 hash:	27d99e06337e063a46cfb61b27c583311fea46bb77b22294407825c9ee1887a0
MD5 hash:	82cd04029bbe5b5b71952f9c791fb0e3
MIME type:	application/x-dosexec
Signature	RemcosRAT

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Trojan.Garf.Gen.7.28194.5458.UNOFFICIAL

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/20d6b4781904d93104efcdc760eb6809714c3eae777fd098840d54008d301f7f/results/dashboard

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

lolbin overlay packed remcos shell32.dll

Link:

https://www.filescan.io/uploads/649ac8770b141afbe5e12f49/reports/5b6ca01a-687b-49ea-a229-3cf62eebc3c7/overview

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/20d6b4781904d93104efcdc760eb6809714c3eae777fd098840d54008d301f7f

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/20d6b4781904d93104efcdc760eb6809714c3eae777fd098840d54008d301f7f

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/20d6b4781904d93104efcdc760eb6809714c3eae777fd098840d54008d301f7f/

Threat name:

Win32.Trojan.Tnega

Status:

Malicious

First seen:

2023-06-27 10:00:15 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

11 of 36 (30.56%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=edlli6azatmtcbhpzxdwb23ibfyuypvoo575bgeebvkabdjqd57q._file

Result

Malware family:

n/a

Score:

7/10

Tags:

persistence

Link:

https://tria.ge/reports/230627-nv55cadh72/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Adds Run key to start application

Executes dropped EXE

Loads dropped DLL

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/20d6b4781904d93104efcdc760eb6809714c3eae777fd098840d54008d301f7f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.