MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 26448f5f651589c5fd39721e68693c8eba2ada59eee363b365b984e90f0a47b0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 26448f5f651589c5fd39721e68693c8eba2ada59eee363b365b984e90f0a47b0
SHA3-384 hash: f074b376cc1448936a08c4b9ed4d671d9577ad091959519c2654e1f5489d991022ab1246b4b6cb2146de931920930379
SHA1 hash: a92ab433d7e109ac4a1d913d6f8bc88e18ca80b0
MD5 hash: c5ca39215eddb502405c7c3862264601
humanhash: missouri-bulldog-solar-fifteen
File name:c5ca39215eddb502405c7c3862264601.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:901'120 bytes
First seen:2020-05-18 07:21:28 UTC
Last seen:2020-05-18 08:23:12 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash a3fde7a8d9e08812d4cb4030810904ff (1 x RemcosRAT)
ssdeep 12288:xxRBPJ0P5ISW7gVsRal9kJChNBbjw4N6G0uopgbbjglrMBKtM3ap4hW4SrKo:PR+HSRa0JChNBQM6G0/SLCv3
Threatray 987 similar samples on MalwareBazaar
TLSH 89157C62B2A1887BC06316742CDF97B59A3ABF012A34854B6BF01D4C2F757913D362B7
Reporter abuse_ch
Tags:exe RAT RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.BorlandCpp-9
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-05-18 02:54:36 UTC
File Type:
PE (Exe)
Extracted files:
38
AV detection:
20 of 31 (64.52%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ezci6x3fcwe4l7jzoipgq2j4r25cvwsz53rwhm3fxgcosdyki6ya._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
487032be06deec0a6b50c6c0464edb67d50f9bb769ea1527969d4b67b83e8733
RemcosRAT
667d35d2cff2979ca84df0afe1eca6c164e1d919b989e16b97166c7a30c77a87
RemcosRAT
91adaeeb7ac7733741a68cc0283a10f64403f64d1378558bae2342bec847f8e5
RemcosRAT
93c327b46d6354a91a9b20311a2f1e1873e132765816ec26443eb1971ccd2946
RemcosRAT
a32c37dd601a6fcdd6e622b2c928c7ef7935a77a0df9a2dfb9c7774630dd266e
RemcosRAT
b8a03fd14b3a3695af8b6c781eb946214a98986279678c6b2a477f22ba1ac3cf
RemcosRAT
c689edeb2bea45f5a7e6402ba51dc23e40e6c8b509841f60cb3d7327340b9b60
RemcosRAT
ca1db184290b274c1f78b091bf019926fa258dd8b1f5bb316a55832aec970338
RemcosRAT
e138622ca793f4a546496b40dcf406a83aa667d16fa2a29879d8282a39d6e7ff
RemcosRAT
f9441d3651d67748ec1a2fd325ea1aa9d914208c7fae0853e5b769e52e66ccb8
RemcosRAT
+ 977 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos rat
Link:
https://tria.ge/reports/201109-ddvlbehdja/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Blacklisted process makes network request
Remcos
Malware Config
C2 Extraction:
37.1.222.252:5851
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_RemcosRAT
Create hunting rule
Author:abuse.ch
Rule name:crime_win32_parallax_payload_1
Create hunting rule
Author:@VK_Intel
Description:Detects Parallax Injected Payload v1.01
Reference:https://twitter.com/VK_Intel/status/1227976106227224578
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

Executable exe 26448f5f651589c5fd39721e68693c8eba2ada59eee363b365b984e90f0a47b0

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/363945/
  
Delivery method
Distributed via web download

Comments