MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 379ce884ab2a4e39bb56560bc8772b7ea44dcd3678d6fabaf62eb3352b1b6018. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 379ce884ab2a4e39bb56560bc8772b7ea44dcd3678d6fabaf62eb3352b1b6018
SHA3-384 hash: f41c5f62dbf58f57da2e1d552aca5c9be1b39938ff456ef578e182631df3fcac34f370b377bd595631fa53177d84acae
SHA1 hash: b3c71cce30bc12146a8593673921ea785a48f794
MD5 hash: 4b0e959018b17ad793c1597629d26c89
humanhash: delaware-harry-yankee-black
File name:_2ndbuild.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:748'032 bytes
First seen:2021-08-11 20:20:18 UTC
Last seen:2021-08-18 13:06:05 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'011 x AgentTesla, 19'917 x Formbook, 12'332 x SnakeKeylogger)
ssdeep 6144:ijxmfaHq2E7uh5MDBU5LNXog9nNPG7NUBgi+Aoq/lqLrBOOYFQSGQ6xRGjLJNMn:ijxmfRDWug9NPGaXqSG5mW
Threatray 1'900 similar samples on MalwareBazaar
TLSH T1FEF4499037EC0B94F6BF2BB4E8B4100147F6B8A7B4B9DB5E4D4064DF48627519A62B33
Reporter Anonymous
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
3
# of downloads :
162
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
_2ndbuild.exe
Verdict:
Suspicious activity
Analysis date:
2021-08-11 20:22:33 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/eb893fe9-caae-43d1-bfb0-b92f057fb2a4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/178389/
Detection(s):
SecuriteInfo.com.UDS.Trojan.MSIL.Remcos.gen.24582.19050.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Connection attempt
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/ada1f213-5cf4-423a-bd21-6528cfc43ca7
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/831244
Signature
Detected Remcos RAT
Malicious sample detected (through community Yara rule)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 463675 Sample: _2ndbuild.exe Startdate: 11/08/2021 Architecture: WINDOWS Score: 56 25 Malicious sample detected (through community Yara rule) 2->25 27 Detected Remcos RAT 2->27 7 _2ndbuild.exe 3 2->7         started        process3 file4 21 C:\Users\user\AppData\...\_2ndbuild.exe.log, ASCII 7->21 dropped 10 _2ndbuild.exe 1 1 7->10         started        13 _2ndbuild.exe 7->13         started        15 _2ndbuild.exe 7->15         started        17 3 other processes 7->17 process5 dnsIp6 23 192.168.0.133, 2404 unknown unknown 10->23 19 conhost.exe 10->19         started        process7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/379ce884ab2a4e39bb56560bc8772b7ea44dcd3678d6fabaf62eb3352b1b6018/
Threat name:
ByteCode-MSIL.Trojan.Remcos
Create hunting rule
Status:
Malicious
First seen:
2021-08-11 20:21:08 UTC
AV detection:
2 of 28 (7.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=g6oorbflfjhdto2wkyf4q5zlp2se3tjwpdlpvoxwf2ztkky3mama._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
0b21cb47c8a19319e7a3ea04878670d09a51e7b377fdcb9e0009f1cb0700348b
RemcosRAT
1cbde001232b05773813dca161a55e63f8e082b7b53f900a4e235d2753bd1957
RemcosRAT
34540a51780e487ff9426db2ea9e2ed985e6c46130439de2e434b4a804446566
RemcosRAT
37a9969f1c0394c3899ffcd2fcebf9c9393bc712da4c80d4cdb2b19adec5334f
RemcosRAT
4c11b7fb217b3675e60d659ce0a2c3eee1bdbd3e3ddba1ad6d762878f62534d1
RemcosRAT
6654c75acd136f37aad63d828eea396361326bb422a91563998ff0302de2bd20
RemcosRAT
ce4962d3126223b4bd68704159cbdc7479fb2df4263fb9f3d57492e770b74a94
RemcosRAT
d45d40989488d330e82db097aa2d857ea5d620526171cd8fb145ef62cb4ea701
RemcosRAT
ed3a96630761ee25131c40b747f50fc55aa85d5e8f631f71bbfc901dd96bac13
RemcosRAT
f19b2e31a0bc55cb5d4ab540605cfeffca6dd241cbe4e96e065d403a7273534a
RemcosRAT
+ 1'890 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/210811-jq3sg5s7hj/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
379ce884ab2a4e39bb56560bc8772b7ea44dcd3678d6fabaf62eb3352b1b6018
MD5 hash:
4b0e959018b17ad793c1597629d26c89
SHA1 hash:
b3c71cce30bc12146a8593673921ea785a48f794
Link:
https://www.unpac.me/results/a4949cb2-2a3e-4409-bfff-9b81c770f4ed/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/379ce884ab2a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/379ce884ab2a4e39bb56560bc8772b7ea44dcd3678d6fabaf62eb3352b1b6018

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Remcos
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Remcos in memory
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.remcos.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Distributed via e-mail link
Cape
Cape
https://www.capesandbox.com/analysis/178389/

Comments