🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 351e1907992deaaac85fefdf4b9e58890e68e69c42a3ead259a371d25ba62cb4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 351e1907992deaaac85fefdf4b9e58890e68e69c42a3ead259a371d25ba62cb4
SHA3-384 hash: 337ab712ee5cf62a1f44b272c9b51f77098844ded4ebc711efb9e24414e689a5653bc13f90bcb046cd3b2f61f1bda01a
SHA1 hash: 9ba07f39eb0febd7fb03c512f7d04a0fd4c0e383
MD5 hash: 69d6b3020062843f8cd3738be3272839
humanhash: september-oklahoma-sierra-eighteen
File name:xhBpgW22.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:94'208 bytes
First seen:2020-03-29 08:15:01 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d3a62971944197f0701c7049a9c739d1 (76 x RemcosRAT)
ssdeep 1536:ohhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP6Er0:uhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+A
Threatray 774 similar samples on MalwareBazaar
TLSH FC93D813FA4AD0B2E46591F145426F32CEBCBC3636492173D38FCA41AD79892D416EBE
Reporter johannes
Tags:remcos RemcosRAT


Avatar
viql
remcos via https://pastebin.com/raw/xhBpgW22

Intelligence

File Origin
# of uploads :
1
# of downloads :
133
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Rescoms-6598304-0
Create hunting rule

Win.Malware.Zusy-6832224-0
Create hunting rule

Win.Malware.Azden-7587127-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Rescoms
Create hunting rule
Status:
Malicious
First seen:
2020-03-29 08:35:28 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
30 of 31 (96.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gupbsb4zfxvkvsc757puxhsyrehgrzu4ikr6vuszuny5ew5gfs2a._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
23735f88fafab80a318fe17447a9eaff8d898daf2f31108c0ab051e50ae16ef5
RemcosRAT
36c0ddbebaeec834aefef44ead907270d13814c446634d4856e9ac27d30ba355
RemcosRAT
56fee643ba39ac908309688827397099ca6b707c45154eb14da1b693f6b16571
RemcosRAT
62115059096fc430f5e8b4cfe6884444fbb2b0733760a7f4a9856791f1151ba9
RemcosRAT
753883fa972dda966abb3adad3cfc94f0a82ca128d1908df58bac3ba93e60bd3
RemcosRAT
89313534a5c4579b6a00425281ef0473246cfb2340653bd3cf41b584bfa40578
RemcosRAT
8f326df009924cd7bf93a0a9cb83f1ae42adec4e7afce32971da35a8d792a223
RemcosRAT
c851749fd6c9fa19293d8ee2c5b45b3dc8561115ddfe7166fbaefcb9b353b7c4
RemcosRAT
d06558cd5d7615d66ea2d806877d962994732909cf003eff4b95d62100840b70
RemcosRAT
e5c170ac2dddf725d95b8ee205461cd734c66e5d3d0492a64dfc1b7670bda5f6
RemcosRAT
+ 764 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://pastebin.com/raw/xhBpgW22

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
GDI_PLUS_APIInterfaces with Graphicsgdiplus.dll::GdiplusStartup
gdiplus.dll::GdipGetImageEncoders
gdiplus.dll::GdipGetImageEncodersSize
gdiplus.dll::GdipAlloc
MULTIMEDIA_APICan Play MultimediaWINMM.dll::waveInAddBuffer
WINMM.dll::waveInClose
WINMM.dll::waveInOpen
WINMM.dll::waveInPrepareHeader
WINMM.dll::waveInStart
WINMM.dll::waveInStop
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AdjustTokenPrivileges
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteA
SHELL32.dll::ShellExecuteExA
SHELL32.dll::ShellExecuteW
URL_MONIKERS_APICan Download & Execute componentsurlmon.dll::URLDownloadToFileA
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessA
KERNEL32.dll::OpenProcess
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::VirtualAllocEx
KERNEL32.dll::WriteProcessMemory
KERNEL32.dll::CloseHandle
WININET.dll::InternetCloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::GetDriveTypeA
KERNEL32.dll::GetStartupInfoA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WinExec
KERNEL32.dll::AllocConsole
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileA
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateDirectoryA
KERNEL32.dll::CreateFileMappingA
KERNEL32.dll::DeleteFileA
KERNEL32.dll::DeleteFileW
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::GetUserNameW
ADVAPI32.dll::LookupPrivilegeValueA
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExA
ADVAPI32.dll::RegCreateKeyA
ADVAPI32.dll::RegDeleteKeyA
ADVAPI32.dll::RegOpenKeyExA
ADVAPI32.dll::RegQueryInfoKeyA
ADVAPI32.dll::RegQueryValueExA
WIN_USER_APIPerforms GUI ActionsUSER32.dll::AppendMenuA
USER32.dll::EmptyClipboard
USER32.dll::FindWindowA
USER32.dll::OpenClipboard
USER32.dll::CreateWindowExA

Comments