MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3667e6ce369da2c3028286f4526ee7995fa618bf56b37b80aa3554227710e1e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3667e6ce369da2c3028286f4526ee7995fa618bf56b37b80aa3554227710e1e4
SHA3-384 hash: 83a96175c4ad9975c3e110b7ccf126d1ee65e5db4338a44a9e7303daa19838fc6d53360fccdbcb2c5084482a7a92f997
SHA1 hash: 6e30c947eeece129185715d211c40d7ba899f876
MD5 hash: b2f2a822d5a37cdb3d40e4fb8ba1d4d9
humanhash: princess-pizza-equal-minnesota
File name:Purchase Order SZ5-9-020,pdf.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:731'648 bytes
First seen:2020-06-03 08:07:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 724b752ce0fa3ad87e4fd6a599bf8e0e (6 x RemcosRAT)
ssdeep 12288:YVa3OouGLMvxj4ZV0Ebhs34epfCAyrWThyzfYQ9YYeHdfg:YVdouXxjWSEbhsba6Th4v3yd
Threatray 788 similar samples on MalwareBazaar
TLSH 0DF48E33F6E04437D22329799C0BA7B5A93ABE113E24AA4627ECCD9C4F7D7417529183
Reporter abuse_ch
Tags:exe nVpn RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: barracuda02.gdsvn.net
Sending IP: 113.52.34.12
From: Mexican Machinery Company S. de R.L. <rodrigo.espinosa@ridgid.com.mx>
Subject: Purchase Order SZ5-9-020
Attachment: Purchase Order SZ5-9-020,pdf.iso (contains "Purchase Order SZ5-9-020,pdf.exe")

RemcosRAT C2:
chukwubueze449.ddns.net (91.193.75.12)

Pointing to nVpn:

% Information related to '91.193.75.0 - 91.193.75.255'

% Abuse contact for '91.193.75.0 - 91.193.75.255' is 'abuse@kgb-vpn.org'

inetnum: 91.193.75.0 - 91.193.75.255
netname: NON-LOGGING-VPN-SERVICE
descr: Please note that we don't store any user data.
descr: Our main effort is not to make money, but to preserve values like the
descr: freedom of expression, the freedom of press, the right to data protection
descr: and informational self-determination.
descr: We ask all employees of Spamhaus and all self-proclaimed deputy sheriffs
descr: to stop your attacks against us.
country: EU
admin-c: KA7109-RIPE
tech-c: KA7109-RIPE
org: ORG-KHd1-RIPE
status: ASSIGNED PI
mnt-by: RIPE-NCC-END-MNT
mnt-by: KGB-MNT
mnt-routes: KGB-MNT
sponsoring-org: ORG-MW1-RIPE
created: 2012-06-04T11:05:55Z
last-modified: 2019-12-05T05:39:00Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 19:23:12 UTC
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gzt6ntrwtwrmgaucq32fe3xhtfp2mgf7k2zxxafkgvkce5yq4hsa._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
1ea80e0718c74846253ea8a2cd308d8c7412d3baf6b23710f4e166c0f34076ce
RemcosRAT
3b13ea61e91a0312f8c187096e435168cee2d2277c46373d01899497345bd0e9
RemcosRAT
4fac48a4dee43b19e11ec467028b4d95ad80accb114e7f2374d0642ce25319c9
RemcosRAT
667d35d2cff2979ca84df0afe1eca6c164e1d919b989e16b97166c7a30c77a87
RemcosRAT
93c327b46d6354a91a9b20311a2f1e1873e132765816ec26443eb1971ccd2946
RemcosRAT
b8a03fd14b3a3695af8b6c781eb946214a98986279678c6b2a477f22ba1ac3cf
RemcosRAT
c0a656a2f73c254ed2f1e73630083849890b7c1e36161e89fe29d2fd014f9fff
RemcosRAT
c7095f2c5ed61c9d667c69aba9d9bc5b87b93f7fad5f49b1d5c66c4eb11b745e
RemcosRAT
dd6cc40b98ec4d9c1413705c105d03f94afcfdc1258a5ab8c39342e71f67e2f9
RemcosRAT
f9441d3651d67748ec1a2fd325ea1aa9d914208c7fae0853e5b769e52e66ccb8
RemcosRAT
+ 778 additional samples on MalwareBazaar
Result
Malware family:
modiloader
Create hunting rule
Score:
  10/10
Tags:
family:modiloader
Link:
https://tria.ge/reports/201109-fb2mqjw54x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Legitimate hosting services abused for malware hosting/C2
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_RemcosRAT
Create hunting rule
Author:abuse.ch
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso 36d458c05545ece2ddfdb3ddd93d58508f14ee5937e926c4de1e7a92c76ad32d

RemcosRAT

Executable exe 3667e6ce369da2c3028286f4526ee7995fa618bf56b37b80aa3554227710e1e4

(this sample)

  
Dropped by
MD5 c83f7ea34ba7fa9d63c4f0af5214e415
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 36d458c05545ece2ddfdb3ddd93d58508f14ee5937e926c4de1e7a92c76ad32d

Comments