MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 39d5de9369e325dcd8f7a15ce88dd495295e87fa945682ae6f454f2f8d0130ad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RemcosRAT
Vendor detections: 13
| SHA256 hash: | 39d5de9369e325dcd8f7a15ce88dd495295e87fa945682ae6f454f2f8d0130ad |
|---|---|
| SHA3-384 hash: | d641de051c8ea6d7061285223e3253927939a189e4fa7b2252b6e90f8d067e49894873593fdeeda3ed8563bb97f240fb |
| SHA1 hash: | 4583d909035d53e1488d926e2147a9de31181ee1 |
| MD5 hash: | 751b6e0bc633b26c52bbc8be230339b7 |
| humanhash: | spring-winner-two-hawaii |
| File name: | 751b6e0bc633b26c52bbc8be230339b7.exe |
| Download: | download sample |
| Signature | RemcosRAT |
| File size: | 466'432 bytes |
| First seen: | 2021-04-13 08:05:28 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 3044bf45883fdbd5ec8c4e64bf749839 (2 x RemcosRAT) |
| ssdeep | 12288:jp85GzC+LZ5DsOwPEsfI2Mt23o/ZMBPYC:u+LZxsJI2M03eZu |
| Threatray | 158 similar samples on MalwareBazaar |
| TLSH | 37A4AE12B592C032C07251741D29FBB5D9FCBD202A6595BB73EA1D6BBE700C0A72A773 |
| Reporter |  abuse_ch |
| Tags: | exe RAT RemcosRAT |
Intelligence
File Origin
# of uploads :
1
# of downloads :
160
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
751b6e0bc633b26c52bbc8be230339b7.exe
Verdict:
Malicious activity
Analysis date:
2021-04-13 08:08:06 UTC
Tags:
rat remcos
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Connecting to a non-recommended domain
Connection attempt
Sending a UDP request
Sending a custom TCP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Remcos
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to capture and log keystrokes
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Delayed program exit found
Detected Remcos RAT
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Detection:
remcos
Threat name:
Win32.Backdoor.Remcos
Status:
Malicious
First seen:
2021-04-13 08:06:09 UTC
AV detection:
31 of 47 (65.96%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
remcos
Similar samples:
+ 148 additional samples on MalwareBazaar
Result
Malware family:
remcos
Score:
10/10
Tags:
family:remcos rat
Behaviour
Remcos
Malware Config
C2 Extraction:
176.111.174.14:20004
Unpacked files
SH256 hash:
39d5de9369e325dcd8f7a15ce88dd495295e87fa945682ae6f454f2f8d0130ad
MD5 hash:
751b6e0bc633b26c52bbc8be230339b7
SHA1 hash:
4583d909035d53e1488d926e2147a9de31181ee1
Detections:
win_remcos_g0
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | ach_RemcosRAT |
|---|---|
| Author: | abuse.ch |
| Rule name: | Chrome_stealer_bin_mem |
|---|---|
| Author: | James_inthe_box |
| Description: | Chrome in files like avemaria |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer |
|---|---|
| Author: | ditekSHen |
| Description: | detects Windows exceutables potentially bypassing UAC using eventvwr.exe |
| Rule name: | Keylog_bin_mem |
|---|---|
| Author: | James_inthe_box |
| Description: | Contains Keylog |
| Rule name: | Parallax |
|---|---|
| Author: | @bartblaze |
| Description: | Identifies Parallax RAT. |
| Rule name: | remcos_rat |
|---|---|
| Author: | jeFF0Falltrades |
| Rule name: | REMCOS_RAT_variants |
|---|
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.================================================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
================================================================================
0) [B0001.025] Anti-Behavioral Analysis::Software Breakpoints
1) [F0002.001] Collection::Application Hook
2) [F0002.002] Collection::Polling
4) [B0030.002] Command and Control::Receive Data
5) [B0030.001] Command and Control::Send Data
6) [C0011.001] Communication Micro-objective::Resolve::DNS Communication
7) [C0002.006] Communication Micro-objective::Download URL::HTTP Communication
8) [C0003.001] Communication Micro-objective::Create Pipe::Interprocess Communication
9) [C0003.003] Communication Micro-objective::Read Pipe::Interprocess Communication
10) [C0003.004] Communication Micro-objective::Write Pipe::Interprocess Communication
11) [C0001.009] Communication Micro-objective::Initialize Winsock Library::Socket Communication
12) [C0001.006] Communication Micro-objective::Receive Data::Socket Communication
13) [C0001.007] Communication Micro-objective::Send Data::Socket Communication
14) [C0029.003] Cryptography Micro-objective::SHA256::Cryptographic Hash
15) [C0027.009] Cryptography Micro-objective::RC4::Encrypt Data
16) [C0028.002] Cryptography Micro-objective::RC4 KSA::Encryption Key
17) [C0021.004] Cryptography Micro-objective::RC4 PRGA::Generate Pseudo-random Sequence
18) [C0021.003] Cryptography Micro-objective::Use API::Generate Pseudo-random Sequence
19) [C0026.002] Data Micro-objective::XOR::Encode Data
21) [C0045] File System Micro-objective::Copy File
22) [C0046] File System Micro-objective::Create Directory
23) [C0048] File System Micro-objective::Delete Directory
24) [C0047] File System Micro-objective::Delete File
25) [C0049] File System Micro-objective::Get File Attributes
26) [C0051] File System Micro-objective::Read File
27) [C0050] File System Micro-objective::Set File Attributes
28) [C0052] File System Micro-objective::Writes File
29) [E1510] Impact::Clipboard Modification
30) [B0022.001] Impact::Reverse Shell
31) [C0007] Memory Micro-objective::Allocate Memory
32) [C0034.001] Operating System Micro-objective::Set Variable::Environment Variable
33) [C0036.004] Operating System Micro-objective::Create Registry Key::Registry
34) [C0036.002] Operating System Micro-objective::Delete Registry Key::Registry
35) [C0036.007] Operating System Micro-objective::Delete Registry Value::Registry
36) [C0036.003] Operating System Micro-objective::Open Registry Key::Registry
37) [C0036.005] Operating System Micro-objective::Query Registry Key::Registry
38) [C0036.006] Operating System Micro-objective::Query Registry Value::Registry
39) [C0036.001] Operating System Micro-objective::Set Registry Key::Registry
40) [C0035] Operating System Micro-objective::Wallpaper
41) [C0040] Process Micro-objective::Allocate Thread Local Storage
42) [C0043] Process Micro-objective::Check Mutex
43) [C0042] Process Micro-objective::Create Mutex
44) [C0017.003] Process Micro-objective::Create Suspended Process::Create Process
45) [C0017] Process Micro-objective::Create Process
46) [C0038] Process Micro-objective::Create Thread
47) [C0054] Process Micro-objective::Resume Thread
48) [C0041] Process Micro-objective::Set Thread Local Storage Value
49) [C0018] Process Micro-objective::Terminate Process
50) [C0039] Process Micro-objective::Terminate Thread