MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3c0f90fd64d02df70663c49b05c1a50075b4f921a1ac7830c31e4eab2d1eaac5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 7


Intelligence 7 IOCs YARA 27 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3c0f90fd64d02df70663c49b05c1a50075b4f921a1ac7830c31e4eab2d1eaac5
SHA3-384 hash: dfcae6b59f69f233d86e5505ad75ac0ad54075ba0441de8b28cf06412cfcf410bd50ffc97e9d26488708f942e5ac2a52
SHA1 hash: 3c537ba15fa9b118fee329ca3d5c74ff598419d8
MD5 hash: cc76a0bf054c2eee953a0620dc5d4c68
humanhash: december-hawaii-helium-indigo
File name:PRODUCT LIST 80487 2024.R00
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:903'803 bytes
First seen:2024-02-06 08:57:35 UTC
Last seen:2024-02-06 08:59:32 UTC
File type: r00
MIME type:application/x-rar
ssdeep 24576:PPk2zRKmXBRHhKWfA+k5bnZFGO9IpdkixZIuNm3:PPk4AmXBRo1+m/79tixI
TLSH T1D515330B340DE78EB1890A0432FDA3610875F070369ED6B876D4AD37249BF94E5EEA57
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:r00 RemcosRAT


Avatar
cocaman
Malicious email (T1566.001)
From: "Avijit Das / Crescent Foundry LLC <alia@hawras.com>" (likely spoofed)
Received: "from woops.hawras.com (woops.hawras.com [185.222.163.60]) "
Date: "Tue, 06 Feb 2024 00:45:22 -0800"
Subject: "ORDER SPECIFICATION AND DRAWING 2024"
Attachment: "PRODUCT LIST 80487 2024.R00"

Intelligence

File Origin
# of uploads :
3
# of downloads :
109
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:PRODUCT LIST 80487 2024.exe
File size:1'179'136 bytes
SHA256 hash: 7d5fb292b4477237a05a35eb135a13c9f6d1177987217e94c3558b91fa97c285
MD5 hash: 1f8a3704996a9d31c8be761ed319b429
MIME type:application/x-dosexec
Signature RemcosRAT
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/65c1f49ea317adb742634411/reports/7d6b7082-9e14-4eda-8c53-acfcbe98af16/overview
Verdict:
Suspicious
Labled as:
Mal/DrodRar
Link:
https://www.hybrid-analysis.com/sample/3c0f90fd64d02df70663c49b05c1a50075b4f921a1ac7830c31e4eab2d1eaac5
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3c0f90fd64d02df70663c49b05c1a50075b4f921a1ac7830c31e4eab2d1eaac5/
Threat name:
ByteCode-MSIL.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2024-02-06 08:57:39 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
16 of 23 (69.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hqhzb7le2aw7obtdysnqlqnfab23j6jbugwhqmgddzhkwli6vlcq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3c0f90fd64d02df70663c49b05c1a50075b4f921a1ac7830c31e4eab2d1eaac5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:iexplorer_remcos
Create hunting rule
Author:iam-py-test
Description:Detect iexplorer being taken over by Remcos
Rule name:INDICATOR_EXE_Packed_MPress
Create hunting rule
Author:ditekSHen
Description:Detects executables built or packed with MPress PE compressor
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Author:ditekSHen
Description:Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:QbotStuff
Create hunting rule
Author:anonymous
Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:TeslaCryptPackedMalware
Create hunting rule
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Windows_Trojan_Remcos_b296e965
Create hunting rule
Author:Elastic Security
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.remcos.
Rule name:win_remcos_rat_unpacked
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in remcos rat Samples.
Rule name:win_remcos_w0
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in remcos rat Samples.
Rule name:yarahub_win_remcos_rat_unpacked_aug_2023
Create hunting rule
Author:Matthew @ Embee_Research
Rule name:yara_template
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

r00 3c0f90fd64d02df70663c49b05c1a50075b4f921a1ac7830c31e4eab2d1eaac5

(this sample)

RemcosRAT

Executable exe 7d5fb292b4477237a05a35eb135a13c9f6d1177987217e94c3558b91fa97c285

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7d5fb292b4477237a05a35eb135a13c9f6d1177987217e94c3558b91fa97c285
  
Dropping
RemcosRAT
  
Dropping
MD5 1f8a3704996a9d31c8be761ed319b429

Comments