MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a6558baa19564bc64f9054329de0f2575b6e2b8ea850d59d2646a6c048401ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 14


Intelligence 14 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3a6558baa19564bc64f9054329de0f2575b6e2b8ea850d59d2646a6c048401ba
SHA3-384 hash: e5ef22bee167735104091111ce6ac2ceb9f7c574b0a7dc6bf4f1a050c3d31cef1df0ccbfb9a42600a9be239c20970e6a
SHA1 hash: 56c5460d5e3575b1a16a0672e63ee7f6cce2d086
MD5 hash: 6b4f80f373aab6c633f88399df306239
humanhash: fruit-apart-ohio-minnesota
File name:3a6558baa19564bc64f9054329de0f2575b6e2b8ea850d59d2646a6c048401ba
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'212'832 bytes
First seen:2021-08-30 07:05:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash afcdf79be1557326c854b6e20cb900a7 (1'102 x FormBook, 936 x AgentTesla, 399 x RemcosRAT)
ssdeep 24576:YEfUzt0WsNtypnSHZNTZ5kB3z0mHaYfltT5Uf1tE:LUztHpS55C3QYaClnG1a
Threatray 1'923 similar samples on MalwareBazaar
TLSH T1AB459E0273919026FEAE92734B55A2415678F8297023CC3F12BBDF786B701621E7D66F
dhash icon 4be5c74fbfbd3bb7 (29 x RemcosRAT)
Reporter JAMESWT_WT
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
114
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
3a6558baa19564bc64f9054329de0f2575b6e2b8ea850d59d2646a6c048401ba
Verdict:
Malicious activity
Analysis date:
2021-08-30 07:09:00 UTC
Tags:
rat remcos
Link:
https://app.any.run/tasks/c9839dba-1171-4e05-b6d7-96aa3994c6b2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/183595/
Detection(s):
Win.Malware.Nymeria-6993200-0
Create hunting rule

Win.Trojan.Autoit-9790152-0
Create hunting rule

Win.Trojan.Autoit-9790155-0
Create hunting rule

Win.Trojan.Autoit-9790166-0
Create hunting rule

Win.Trojan.Autoit-9790168-0
Create hunting rule

Win.Trojan.Autoit-9790176-0
Create hunting rule

Win.Trojan.Autoit-9790695-0
Create hunting rule

Win.Trojan.Nanocore-9789919-1
Create hunting rule

Win.Trojan.Autoit-9792204-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% subdirectories
Unauthorized injection to a recently created process
Query of malicious DNS domain
Enabling autorun by creating a file
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/799d9016-78cd-489e-92d0-c02a94d63d8f
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/841420
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
AutoIt script contains suspicious strings
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Detected Remcos RAT
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Uses dynamic DNS services
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 473852 Sample: gETQL8RWt5 Startdate: 30/08/2021 Architecture: WINDOWS Score: 100 26 rem-pounds.ddns.net 2->26 30 Found malware configuration 2->30 32 Malicious sample detected (through community Yara rule) 2->32 34 Antivirus / Scanner detection for submitted sample 2->34 36 7 other signatures 2->36 7 drvinst.exe.bat 2->7         started        10 gETQL8RWt5.exe 5 2->10         started        signatures3 process4 file5 38 Antivirus detection for dropped file 7->38 40 Binary is likely a compiled AutoIt script file 7->40 42 Contains functionality to inject code into remote processes 7->42 44 Injects a PE file into a foreign processes 7->44 13 drvinst.exe.bat 7->13         started        15 drvinst.exe.bat 7->15         started        17 drvinst.exe.bat 7->17         started        22 4 other processes 7->22 24 C:\Users\user\AppData\...\drvinst.exe.bat, PE32 10->24 dropped 19 gETQL8RWt5.exe 2 10->19         started        signatures6 process7 dnsIp8 28 rem-pounds.ddns.net 19->28
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/3a6558baa19564bc64f9054329de0f2575b6e2b8ea850d59d2646a6c048401ba/
Threat name:
Win32.Trojan.Remcos
Create hunting rule
Status:
Malicious
First seen:
2021-08-24 13:21:38 UTC
File Type:
PE (Exe)
Extracted files:
17
AV detection:
36 of 46 (78.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hjsvrovbsvslyzhzavbstxqpev23nyvy5kcq2wosmrvgybeeag5a._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
0846f11a89ffa91fb4e519d10e65a260032870e77d0a37d9bd3c9c4404337c83
RemcosRAT
1dc9c08803cc564e3d16d52d6df79534fe167c40674e87093bae452799e9e665
RemcosRAT
388a7968ce64a2834be388b83ead8011a8f3ab4c40bfd5588beedb89d9409b4d
RemcosRAT
48e2cb8cb703d800dc5badbcd4b41fa1feff3610728bbe838a49a9b7be8077fa
RemcosRAT
54cf1e0e02aaef981cb9edbbe174c1fad91304e9af3f418dbf681e712e01cd06
RemcosRAT
63740d7b3addf0f30f355423d35734d95a58bcd459272c26529f148f245c4c24
RemcosRAT
6666e032e70f39e03afd69d2a06fdf9861e3bc1dd0940706b4fc57ab7fe87a37
RemcosRAT
774a46e4bb4ee0cb2586e6bd1de176a0c55ecae0189a2c6b8ba268f5b971c383
RemcosRAT
c6e477905dcc8e39d4e54d40868671cb4eda4bf8bb32c52d320f02b0485b8ff8
RemcosRAT
d31e14f4a5e7503e2fc47e0d20070b2abce700da82fc93bee2bf233f541c39c5
RemcosRAT
+ 1'913 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:admin rat
Link:
https://tria.ge/reports/210830-49e661kg4x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Drops startup file
Remcos
Malware Config
C2 Extraction:
rem-pounds.ddns.net:9970
Unpacked files
SH256 hash:
94b37e1cbab651f75987b27fd437308b24a2ae215da571363c5d2e5451ed63c6
MD5 hash:
46d3df890c4c2fb398fa96680f55c44c
SHA1 hash:
422799d4b08b7a3bf18954df246e8b6986f3dfe1
Detections:
win_remcos_g0
Create hunting rule
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/e19ef26c-c373-417d-96e9-71a98164cd1a/
Parent samples :
80dd0d89780a59dd131881c8503f3eb2106c1dcae7888566b9571e18c580d05f
b5967fe6359fde146d38e8f2e4e61f4028c5d33480be65e8f5775e952863eabe
9d147ba98c3a67c12b070514002aee52b76aaa88b4d9c912a775294de40f5de7
56fe230254e4449612af641cff60fb756e926cf9e8af3246c18b995054e0237c
9002054d4f87d1692ac0764ba3afe0ed4b605b1d1603956f511dbe643e4f6d25
7777da5464cf5fd37b2e2148b46a7793e1934312d5ac19875051ec91c1b5b9ce
1502fdb0d28354b2792d36afdddbf0af183f5813dec09e9592300d66be8e8d4a
07fa20680087f91b4d1cf63d0e1f64ae4b5cfca3bb1a6aef7b6901a31d6ced6f
244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66
e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85
60bf627b2c58512b45ff26c454e5e5627992fdd9a6f6291d34a6981bbbfd4fa3
ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd
e4a64d789455daf8d07ad6fb7a957afd61bf2cad41fbb8de6f3aa46b8d97f782
388a7968ce64a2834be388b83ead8011a8f3ab4c40bfd5588beedb89d9409b4d
3a6558baa19564bc64f9054329de0f2575b6e2b8ea850d59d2646a6c048401ba
d31e14f4a5e7503e2fc47e0d20070b2abce700da82fc93bee2bf233f541c39c5
a3476a145b528bff0519f4816509a99ee7c5bcf26ae6d5c14e97dbdc8dca2e8e
213bcad82af422ce031763f90a15e7683835446ec242ed66894e575a637cb97e
6666e032e70f39e03afd69d2a06fdf9861e3bc1dd0940706b4fc57ab7fe87a37
fcc162c06cebef3b1ea5c21973c4e8009a48925b30d88545f103bdac53a80e23
c09a289502c5bf733a43098234e2d085d53fab557ff778e2fcd73e6c502a4fbb
6cabd12b4721fe31bc5472ced29d5f15ef784c8f25a35849f53062e80c562e81
4a2bb2d7dbf4f33e9ab0304d53af68a2611e79e3f9e48a6d361bb888ac862799
c90723df5e90e7cf8953ffaf51f8a5d6ea306e100ff4e188975cdcf47e2eb7a8
1612b8acf7d09b6ce3587b017527ee09135118aa900768e9368a6d5dc01dedaa
fb8180d56093bf831dcebf35a3035dbbb0c05e730c41792c840a2fa9ba495adf
f460e944a3270d9cc89b1ed57826a3b9c6af804a1f2e79e166d91d34645053ce
f9b4774fa793a9a4e81ad77de7fea5e8b1a864a5499b420042ed59764478c086
762398adabddbcb02d68ba899dbf6f6f04ee4102be002d091ce5170625fc67a9
SH256 hash:
3a6558baa19564bc64f9054329de0f2575b6e2b8ea850d59d2646a6c048401ba
MD5 hash:
6b4f80f373aab6c633f88399df306239
SHA1 hash:
56c5460d5e3575b1a16a0672e63ee7f6cce2d086
Link:
https://www.unpac.me/results/e19ef26c-c373-417d-96e9-71a98164cd1a/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/3a6558baa195/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3a6558baa19564bc64f9054329de0f2575b6e2b8ea850d59d2646a6c048401ba

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_RemcosRAT
Create hunting rule
Author:abuse.ch
Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE).
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:Parallax
Create hunting rule
Author:@bartblaze
Description:Identifies Parallax RAT.
Rule name:Remcos
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Remcos in memory
Rule name:remcos_rat
Create hunting rule
Author:jeFF0Falltrades
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.remcos.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/183595/

Comments