MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2db8a74e308420eb383bc8c609a8652b7a46fc70119cf5152259592c2dcf27fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 6

Intelligence 6 IOCs YARA 6 File information Comments

SHA256 hash:	2db8a74e308420eb383bc8c609a8652b7a46fc70119cf5152259592c2dcf27fa
SHA3-384 hash:	9dd8ba34604aea36df5a6eca6e4e304055cce8106e3e3bc58b7a72a187ee266f556e68674c5cb77d5a3826db5256e9f0
SHA1 hash:	5d64859095d60541c240ae1e68cf88c4fc6b4522
MD5 hash:	ea6372f32f4211dafa615f74fc046b16
humanhash:	alaska-twelve-texas-delaware
File name:	CQ GGM 41pcs F2doc.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	420'412 bytes
First seen:	2020-11-06 17:41:35 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	7c2c71dfce9a27650634dc8b1ca03bf0 (160 x Loki, 58 x Formbook, 55 x Adware.Generic)
ssdeep	6144:xPCganNBq5RHru0oPTlPr+xi8b8+tyy19ERcobv1um+4grJGuYZtDuKnZcxz+fRQ:vanPmzoPIisN9Aum+4iGuYnDuPxz+K
Threatray	337 similar samples on MalwareBazaar
TLSH	5D94234B7AD1E663C25302B04872AFEBAF14A75D49939FC743897B9B3C92587076E0C1
Reporter	abuse_ch
Tags:	exe RAT RemcosRAT

abuse_ch

Malspam distributing RemcosRAT:

HELO: mark.com
Sending IP: 173.249.47.215
From: GGM - USA <glynn@joyceswift.cf>
Subject: Re: New Order / Sales contract
Attachment: CQ GGM 41pcs F2.doc.arj (contains "CQ GGM 41pcs F2doc.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

137

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

PUA.Win.Downloader.Soft32downloader-6691270-0

PUA.Win.Adware.Browserio-6725861-0

SecuriteInfo.com.Artemis162931E90DCF.4593.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Sending a UDP request

Launching a process

Result

Threat name:

Remcos

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/523516

Signature

Contains functionality to capture and log keystrokes

Contains functionality to inject code into remote processes

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Detected Remcos RAT

Hijacks the control flow in another process

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Sigma detected: Remcos

Yara detected Remcos RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2db8a74e308420eb383bc8c609a8652b7a46fc70119cf5152259592c2dcf27fa/

Threat name:

Win32.Infostealer.Fareit

Status:

Malicious

First seen:

2020-11-06 17:06:03 UTC

AV detection:

23 of 29 (79.31%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=fw4kotrqqqqowob3zddatkdffn5en7dqcgopkfjclfmsylope75a._file

Verdict:

unknown

RemcosRAT

0f0033179b2be96981b8425066f35653f6c6fe580f7283a25f920201ddceda5c

RemcosRAT

4600a50935f86662f97f8fb6aa937ba8118ecedf578b62acb5eefe5cd0ac51fa

RemcosRAT

5e23eed104a5bd67c8ae3abe1f3554abac8500bf9f916992df36246b06f14419

RemcosRAT

657a84ee835cf7d47f30fa352ab511e15ec8235bf7876f4264cf9885e10aee57

RemcosRAT

6847d25820be1a4d252df58d3652e103f33af5a43f12febeae71ac66385b0380

RemcosRAT

6a21846587937c0cb2691901a619fe0c4553ca525bb0f4fa382eceebbc3e6c4d

RemcosRAT

c2f42cfcfafad77546d57cbfde6a6f4c1c75d684a81304d1ec901285b1873bd3

RemcosRAT

c431a2df37a74aba2e2d4aba3b6261540ec26923a5ed97017ec92561ac926014

RemcosRAT

d1a298c0dc595b5860a8705fcf316d031704605ee23bed6afa2baf6a18c9f68e

RemcosRAT

+ 327 additional samples on MalwareBazaar

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos rat

Link:

https://tria.ge/reports/201106-bte7brc9vj/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Loads dropped DLL

Blacklisted process makes network request

Remcos

Malware Config

C2 Extraction:

185.140.53.188:7809

Unpacked files

SH256 hash:

2db8a74e308420eb383bc8c609a8652b7a46fc70119cf5152259592c2dcf27fa

MD5 hash:

ea6372f32f4211dafa615f74fc046b16

SHA1 hash:

5d64859095d60541c240ae1e68cf88c4fc6b4522

Link:

https://www.unpac.me/results/04660251-120f-4469-a3cf-4660c4f2142c/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_RemcosRAT Create hunting rule
Author:	abuse.ch

Rule name:	Chrome_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Chrome in files like avemaria

Rule name:	Keylog_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Contains Keylog

Rule name:	Parallax Create hunting rule
Author:	@bartblaze
Description:	Identifies Parallax RAT.

Rule name:	Remcos Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Remcos in memory

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator