MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3bb14e5efcb0ed1f3ecdda6a5680e9940b7bf8cca0ca1c2bc428e588e20ba86c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 8

Intelligence 8 IOCs YARA 9 File information Comments

SHA256 hash:	3bb14e5efcb0ed1f3ecdda6a5680e9940b7bf8cca0ca1c2bc428e588e20ba86c
SHA3-384 hash:	a7d53ce93d9db8a1ad823cc8c09452b8c7053323ed1879e5ac717a9e0862ac012d97d3cc1739d6632562143abe57507a
SHA1 hash:	0eaba7ae05a5e0c187dddc3036397211009f17a0
MD5 hash:	e040542b21408dabaa3f2d40b824bd84
humanhash:	ceiling-uranus-bluebird-paris
File name:	E-file Application.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	668'432 bytes
First seen:	2021-01-21 06:19:59 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	5064414005440c05f6346292b90ee3f2 (7 x RemcosRAT, 3 x Loki, 2 x ModiLoader)
ssdeep	12288:8Nx7I7LYl/9l89x3hemQ4pYut1QocOcqYqsps7o:8jl/9l+x31QcHGOcq9spEo
Threatray	41 similar samples on MalwareBazaar
TLSH	2FE48E26F2E14937D13B26795D1B9764EC36BE013D38984A2BE53C4C8F39351393A2A7
Reporter	abuse_ch
Tags:	exe nVpn RAT RemcosRAT

abuse_ch

Malspam distributing RemcosRAT:

HELO: vps.pmt.co.id
Sending IP: 43.229.85.232
From: IRS <e-service@irs.com>
Subject: E-file Provider Services
Attachment: E-file Application.img (contains "E-file Application.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

141

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

E-file Application.exe

Verdict:

No threats detected

Analysis date:

2021-01-21 06:23:40 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/8d0e655a-3189-4ae7-ab24-3fd2419dd3a7

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/113215/

Detection(s):

PUA.Win.Trojan.Generic-6629274-0

PUA.Win.Adware.Slugin-6803969-0

PUA.Win.Adware.Slugin-6840354-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

DNS request

Sending a custom TCP request

Creating a file

Sending a UDP request

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/587020

Signature

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3bb14e5efcb0ed1f3ecdda6a5680e9940b7bf8cca0ca1c2bc428e588e20ba86c/

Threat name:

Win32.Trojan.Delf

Status:

Malicious

First seen:

2021-01-21 06:20:12 UTC

AV detection:

18 of 46 (39.13%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=hoyu4xx4wdwr6pwn3jvfnahjsqfxx6gmudfbyk6efdsyryqlvbwa._file

Verdict:

malicious

RemcosRAT

4573443acbca7a1f829d721f95c2944a6a2ddd97a4bf484fd993f748d298b285

RemcosRAT

544addebbf8ea00ed593dce1a7ff350ea6222d7ecbec5e81158735a33b11729e

RemcosRAT

817a2e3808a201ec10ce3c1181e88a0d88f1605dc2c31e2809f3b3d7340959d0

RemcosRAT

a4ab58cc18771c7141e96d45714b7aeb046ff7173ec5266f08da7b28d411744e

RemcosRAT

bb639bf4f7fe2289c7aac466c738998a83d6057f961c6eee77e51bc4e24eee00

RemcosRAT

c3daf1d20367ee0d7a849419594356ec6cad7c9169107b332c64ab67cb739823

RemcosRAT

c7bd80117055942f0f622a346479856e7272fb071dd1d709387dd4c8fd4f2ea5

RemcosRAT

c7d2763c845a08a22775c242be4368bbad967ae4d2f82be1042645d6a70320a5

RemcosRAT

df25440a54d9c6a3984aaca69287609df2872b64a8f0a5f5daa42fefad4c5070

RemcosRAT

+ 31 additional samples on MalwareBazaar

Result

Malware family:

modiloader

Score:

10/10

Tags:

family:modiloader

Link:

https://tria.ge/reports/210121-3betm3w9v6/

Behaviour

Modifies system certificate store

Script User-Agent

Unpacked files

SH256 hash:

3bb14e5efcb0ed1f3ecdda6a5680e9940b7bf8cca0ca1c2bc428e588e20ba86c

MD5 hash:

e040542b21408dabaa3f2d40b824bd84

SHA1 hash:

0eaba7ae05a5e0c187dddc3036397211009f17a0

Link:

https://www.unpac.me/results/dac63b80-0bce-4556-9a0e-fcdf4fe5d904/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3bb14e5efcb0ed1f3ecdda6a5680e9940b7bf8cca0ca1c2bc428e588e20ba86c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_RemcosRAT Create hunting rule
Author:	abuse.ch

Rule name:	Chrome_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Chrome in files like avemaria

Rule name:	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer Create hunting rule
Author:	ditekSHen
Description:	detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Rule name:	Keylog_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Contains Keylog

Rule name:	Parallax Create hunting rule
Author:	@bartblaze
Description:	Identifies Parallax RAT.

Rule name:	Remcos Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Remcos in memory

Rule name:	remcos_rat Create hunting rule
Author:	jeFF0Falltrades

Rule name:	REMCOS_RAT_variants Create hunting rule

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator