MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2975614f14f46d3371892e1ffb6cf2e6850db25349be159061d6f78969ed089e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2975614f14f46d3371892e1ffb6cf2e6850db25349be159061d6f78969ed089e
SHA3-384 hash: 0cf38bdd46467101173753f5571210595fc78a53fc07d0df5489647d53b6d30635535fc111f9e7bfe0c5aaac53a8775d
SHA1 hash: 35329b7596a96db9bbd85ee622008f0385c3ca67
MD5 hash: 7c1ab7c8f53cdcce68960bf020552da0
humanhash: social-florida-bulldog-tennessee
File name:da939e801f5b28aae18cbf5e6de6d1e3
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'449'472 bytes
First seen:2020-11-17 15:40:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'643 x Formbook, 12'245 x SnakeKeylogger)
ssdeep 12288:c0GPIaePliYy9sQorU34nUNPjauOZnFJWUcvXsmIyoaZeOHI68Rh5g7gaXRujcih:c0TP/y9My4nX0vXgyIKuaXAdCimpt
TLSH 0D65C49D3260B6EFC857CD36DAA81C24FB6074BA830BE243A05716ED994D59BCF144F2
Reporter seifreed
Tags:RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Packed.Fileinfectorx-9794615-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Creating a file
Reading critical registry keys
Setting a global event handler for the keyboard
Sending a TCP request to an infection source
Stealing user critical data
Enabling autorun by creating a file
Unauthorized injection to a system process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2975614f14f46d3371892e1ffb6cf2e6850db25349be159061d6f78969ed089e/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 15:47:12 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ff2wctyu6rwtg4mjfyp7w3hs42cq3mstjg7bledb233ys2pnbcpa._file
Unpacked files
SH256 hash:
2975614f14f46d3371892e1ffb6cf2e6850db25349be159061d6f78969ed089e
MD5 hash:
7c1ab7c8f53cdcce68960bf020552da0
SHA1 hash:
35329b7596a96db9bbd85ee622008f0385c3ca67
Link:
https://www.unpac.me/results/514e703c-dce4-4ab6-9fe3-e1b55780e159/
SH256 hash:
74c9a0fa99d92ac6ac58860984b8d7a37ce3a880c24f00fbe1a989a881236c1a
MD5 hash:
768407d0244d5d88e7eea4c9949849ff
SHA1 hash:
5e3feed0dc7a13760c7d706cd80ca74ad3d288fb
Link:
https://www.unpac.me/results/514e703c-dce4-4ab6-9fe3-e1b55780e159/
SH256 hash:
fc4d03e3015419baa346f7f060fdf9279497c0168122f5404a3922ea3bb7c484
MD5 hash:
f3664a05a14f03f6e640fd3495d36df5
SHA1 hash:
c2c5dc12e72d284fb616c3532745d3e135d5968d
Link:
https://www.unpac.me/results/514e703c-dce4-4ab6-9fe3-e1b55780e159/
SH256 hash:
bac5797bde4b2810766a40d95bcdb825ac5b395fcbadd139daa19a44a6cdc049
MD5 hash:
a92cc1f6e0a2742350dfda6726db14c0
SHA1 hash:
e5404e3ed46498deb8ad8966a774540c2b8e9c1e
Link:
https://www.unpac.me/results/514e703c-dce4-4ab6-9fe3-e1b55780e159/
SH256 hash:
36804ad3d1fbcf8b501bc731ed89601583e8504585fe8ce47ad08e07680ad427
MD5 hash:
7b3a2b90f390a38099085aa50895f112
SHA1 hash:
d5f82e57821194b285adfb13d0b1f8427341ce75
Detections:
win_remcos_g0
Create hunting rule
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/514e703c-dce4-4ab6-9fe3-e1b55780e159/
Parent samples :
09f6c4b28ed0490da8a1cfd3e03c820ed0bd2cedd2eade3a9af79da2d6891be4
b53dd0324062e8b606ed06d7380138592c98e939dc67e8d2e0a5d646432582c3
053342b8af6c0e321532e1e69b78d1d54a5dce71a3cd35aeb8cf9d80406b6947
2975614f14f46d3371892e1ffb6cf2e6850db25349be159061d6f78969ed089e
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_RemcosRAT
Create hunting rule
Author:abuse.ch
Rule name:Chrome_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Chrome in files like avemaria
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:Parallax
Create hunting rule
Author:@bartblaze
Description:Identifies Parallax RAT.
Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:Remcos
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Remcos in memory
Rule name:remcos_rat
Create hunting rule
Author:jeFF0Falltrades
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments