MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 31963673bc347fe4a6c795c90a0bcbddbf701158feab1b831bce2b082aeacf7f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 31963673bc347fe4a6c795c90a0bcbddbf701158feab1b831bce2b082aeacf7f
SHA3-384 hash: 3f6d1771367415f9e3b91b2cd89d237c73ab8fd73a2fccafd289e73c31ee0fca58e7a51b4ebc882e6a57117e3214d492
SHA1 hash: 786dc4d5047c87d5a54996f6ae19d933c19df28e
MD5 hash: 58777bbc37895b8b62f7321b345e3e07
humanhash: washington-colorado-football-massachusetts
File name:OC CVE6535 _TVOP-MIO 16(C) 2020,pdf.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:646'808 bytes
First seen:2020-10-16 18:57:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash af00c2cd3e1abe86ddbb239e27958d26 (6 x ModiLoader, 3 x RemcosRAT, 1 x Formbook)
ssdeep 12288:BEu6Ai+3QzSx++O8AySJxv/EJIy3m8A71UzFvCM2T4F1smtv1mHRm4DhKte1NDGw:F6pexT1YJS8xZzet0meNr91
Threatray 1'083 similar samples on MalwareBazaar
TLSH 1FD48E66F2D1C837C373257C8C5B96B49825BD9D2F2569772AE83D8C5F393823429283
Reporter abuse_ch
Tags:exe RemcosRAT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: cloudserver10.qpc.co.th
Sending IP: 203.154.39.142
From: GOLIARD Sp. z o.o. <Bogumila.k@goliard.pl>
Subject: RE: POTWIERDZENIE ZAMÓWIENIA CVE6535
Attachment: OC CVE6535 _TVOP-MIO 16C 2020,pdf.iso (contains "OC CVE6535 _TVOP-MIO 16(C) 2020,pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/72253/
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
DNS request
Sending a custom TCP request
Creating a file
Launching a process
Running batch commands
Creating a process with a hidden window
Deleting a recently created file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Connection attempt to an infection source
Unauthorized injection to a system process
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/494125
Signature
Allocates memory in foreign processes
Contains functionality to capture and log keystrokes
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Creates a thread in another existing process (thread injection)
Detected Remcos RAT
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Fodhelper UAC Bypass
Sigma detected: Remcos
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 299512 Sample: OC CVE6535 _TVOP-MIO 16(C) ... Startdate: 16/10/2020 Architecture: WINDOWS Score: 100 47 Malicious sample detected (through community Yara rule) 2->47 49 Multi AV Scanner detection for submitted file 2->49 51 Detected Remcos RAT 2->51 53 8 other signatures 2->53 8 OC CVE6535 _TVOP-MIO 16(C) 2020,pdf.exe 1 15 2->8         started        13 Pirxdrv.exe 13 2->13         started        15 Pirxdrv.exe 13 2->15         started        process3 dnsIp4 43 cdn.discordapp.com 162.159.133.233, 443, 49724, 49751 CLOUDFLARENETUS United States 8->43 39 C:\Users\user\AppData\Local\...\Pirxdrv.exe, PE32 8->39 dropped 55 Writes to foreign memory regions 8->55 57 Allocates memory in foreign processes 8->57 59 Creates a thread in another existing process (thread injection) 8->59 17 notepad.exe 4 8->17         started        20 ieinstal.exe 2 8->20         started        61 Multi AV Scanner detection for dropped file 13->61 63 Injects a PE file into a foreign processes 13->63 23 ieinstal.exe 13->23         started        45 162.159.135.233, 443, 49754 CLOUDFLARENETUS United States 15->45 25 ieinstal.exe 15->25         started        file5 signatures6 process7 dnsIp8 37 C:\Users\Public37atso.bat, ASCII 17->37 dropped 27 cmd.exe 1 17->27         started        29 cmd.exe 1 17->29         started        41 insidelife1.ddns.net 216.38.7.231, 49755, 49756, 49757 ASN-GIGENETUS United States 20->41 file9 process10 process11 31 conhost.exe 27->31         started        33 reg.exe 1 1 27->33         started        35 conhost.exe 29->35         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/31963673bc347fe4a6c795c90a0bcbddbf701158feab1b831bce2b082aeacf7f/
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-10-16 18:01:20 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ggldm454gr76jjwhsxequc6l3w7xaeky72vrxay3zyvqqkxkz57q._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
46ff7f6619eda7e3b2c5b36a2d3f21b154749d31ae2695c4d23c992361ce1f58
RemcosRAT
47d694226b7f034e868ded9f3ebc12b1afbf9bbccb791f4a98c61955f10efa19
RemcosRAT
5b1f1843bbb992e3d5c635aa69d8409de4ae4d3f04cf19994d8e953e99cf451a
RemcosRAT
8f3b6a725b06abd223aa214244ba4756cba52419dd116506744c386133a805fe
RemcosRAT
99a8e371d2d05838012be53f7e86a675acdc9be4770eb4372779a85a574c2f1a
RemcosRAT
9b60c965a1425ff01954ce6a917cb4486d5af5cb36f538233139042ea324a64e
RemcosRAT
b8c6d9ced99143d34fd8829125c6ff46bc0c55569f401ec4d1354f3d0825c4c4
RemcosRAT
c358b44f578fd2dedbb1899038415395ae2052c113aaa149481cde295e022bda
RemcosRAT
ce30dea0b1d4fa181753600eb63c1d2f1a7de1bd848dcdbe196f6a35afef0ea9
RemcosRAT
fb28260466e3ce4029f48c81b60a1ef83e755e772672a28cea1f00f51984c808
RemcosRAT
+ 1'073 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
persistence trojan family:modiloader rat family:remcos
Link:
https://tria.ge/reports/201016-x1yaf6dfyx/
Behaviour
Modifies registry key
Modifies system certificate store
Suspicious use of WriteProcessMemory
Adds Run key to start application
ModiLoader First Stage
ModiLoader Second Stage
ModiLoader, DBatLoader
Remcos
Unpacked files
SH256 hash:
31963673bc347fe4a6c795c90a0bcbddbf701158feab1b831bce2b082aeacf7f
MD5 hash:
58777bbc37895b8b62f7321b345e3e07
SHA1 hash:
786dc4d5047c87d5a54996f6ae19d933c19df28e
Link:
https://www.unpac.me/results/b70fe653-7a45-4cd7-9ea7-cbf36706e490/
SH256 hash:
31fe3abd6c4e6bed858395de0c0c3696b62ca6959b8b9e432613fdb8e48b1dd2
MD5 hash:
ce6615bd3b4282a9e849a8c8c1e89e5b
SHA1 hash:
9b502f51ff08eb54aa9454da0a0d96a8fdd3f855
Link:
https://www.unpac.me/results/b70fe653-7a45-4cd7-9ea7-cbf36706e490/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/31963673bc347fe4a6c795c90a0bcbddbf701158feab1b831bce2b082aeacf7f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso 06f16311aa40919a7b749f7b7ac93fa6b991e2f021c8a09ae06d2584c7128db7

RemcosRAT

Executable exe 31963673bc347fe4a6c795c90a0bcbddbf701158feab1b831bce2b082aeacf7f

(this sample)

  
Dropped by
MD5 6d9a74735165527168b0a8e8a1b9fc76
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/72253/
  
Dropped by
SHA256 06f16311aa40919a7b749f7b7ac93fa6b991e2f021c8a09ae06d2584c7128db7

Comments