MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3ed85c60a5587bcf3c5c7cffd46c90491dfc3e3e74f91aac3f91c429a63c1792. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 20


Intelligence 20 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3ed85c60a5587bcf3c5c7cffd46c90491dfc3e3e74f91aac3f91c429a63c1792
SHA3-384 hash: e90d77a016cc15e6b0942a8746ff223909e7c04ce260be85712864eaec3415c47c0d5d0c4365848bfa8a359161f94862
SHA1 hash: b46651d72a79ee7b925961d51fc81272dc19f379
MD5 hash: 6b921836f458d5df0e13f0681d987e6c
humanhash: moon-mango-ten-helium
File name:RFQ_QUOTATION MTG-189-89791.pdf(93KB).com
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:755'200 bytes
First seen:2026-01-28 19:21:04 UTC
Last seen:2026-02-05 15:54:28 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'793 x AgentTesla, 19'692 x Formbook, 12'274 x SnakeKeylogger)
ssdeep 12288:HtDuCnolCsoYdAA9mJadBeFZYBpqEC1xv0oi7QcKRhktfzwLM:HVufMs1hsAdBen2pqpPPTM
Threatray 6 similar samples on MalwareBazaar
TLSH T1EFF4CF0413E88648F8BE9B349177371147F0B41AD97AEFAFA3C460B91C36B949697723
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10522/11/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter threatcat_ch
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
136
Origin country :
CH CH
Vendor Threat Intelligence
No detections
Malware family:
remcos
Create hunting rule
ID:
1
File name:
_3ed85c60a5587bcf3c5c7cffd46c90491dfc3e3e74f91aac3f91c429a63c1792.exe
Verdict:
Malicious activity
Analysis date:
2026-01-28 19:22:28 UTC
Tags:
netreactor loader java auto-reg stealer evasion auto-startup darkcloud phantom rat remcos
Link:
https://app.any.run/tasks/3092c565-30f2-4ff3-8e3b-d8e1ef162103

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/50558/
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=697a61b86fa3eed1652ffe32
Tags:
virus micro msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Launching a process
Creating a process with a hidden window
DNS request
Connection attempt
Sending an HTTP GET request
Creating a file in the %AppData% directory
Creating a process from a recently created file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm base64 crypt masquerade obfuscated obfuscated obfuscated packed reconnaissance soft-404 vbnet
Link:
https://www.filescan.io/uploads/697a61b4a57b6af70d110680/reports/e6a2e8b7-4740-40a2-9562-4bbab6ad715b/overview
Verdict:
Malicious
Labled as:
Trojan.MSIL.Basic.8
Link:
https://www.hybrid-analysis.com/sample/3ed85c60a5587bcf3c5c7cffd46c90491dfc3e3e74f91aac3f91c429a63c1792
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-01-28T14:44:00Z UTC
Last seen:
2026-01-30T12:41:00Z UTC
Hits:
~1000
Detections:
Trojan-PSW.Win32.Stealer.sb Trojan-Downloader.Win32.PsDownload.sb Backdoor.Agent.TCP.C&C Backdoor.MSIL.XWorm.b Backdoor.MSIL.XWorm.a Trojan-PSW.Win32.Disco.sb Trojan-PSW.Win32.Coins.sb Trojan-PSW.MSIL.Stealerium.sb Trojan.MSIL.Inject.sb PDM:Exploit.Win32.Generic Backdoor.Androm.HTTP.C&C PDM:Trojan.Win32.Generic HEUR:Trojan-PSW.MSIL.Stealerium.gen HEUR:Trojan-PSW.MSIL.DarkCloud.gen Trojan.APosT.UDP.C&C Trojan.MSIL.Agent.sb Backdoor.MSIL.Crysan.d Email-Worm.LovGate.TCP.C&C Trojan.MSIL.Inject.b HackTool.ReconScan.TCP.ServerRequest VHO:Trojan-Spy.Win32.Noon.gen VHO:Backdoor.MSIL.XWorm.gen VHO:Trojan-PSW.MSIL.Stealerium.gen HEUR:Trojan.MSIL.Quasar.gen
Link:
https://opentip.kaspersky.com/3ed85c60a5587bcf3c5c7cffd46c90491dfc3e3e74f91aac3f91c429a63c1792/results?tab=lookup
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3bf07637-fa85-482d-b74c-99dcd8f2f2d7
Result
Threat name:
Remcos, DarkCloud, DarkTortilla, KeyLogg
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1859354
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Creates a thread in another existing process (thread injection)
Creates autostart registry keys to launch java
Creates multiple autostart registry keys
Document exploit detected (process start blacklist hit)
Encrypted powershell cmdline option found
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Potential dropper URLs found in powershell memory
Powershell drops PE file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Notepad Making Network Connection
Sigma detected: Remcos
Sigma detected: Suspicious Binary In User Directory Spawned From Office Application
Sigma detected: Suspicious Microsoft Office Child Process
Sigma detected: Suspicious Process Parents
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Costura Assembly Loader
Yara detected DarkCloud
Yara detected DarkTortilla Crypter
Yara detected Keylogger Generic
Yara detected Phantom stealer
Yara detected PureLog Stealer
Yara detected Quasar RAT
Yara detected Remcos RAT
Yara detected Telegram RAT
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1859354 Sample: RFQ_QUOTATION  MTG-189-8979... Startdate: 28/01/2026 Architecture: WINDOWS Score: 100 113 wqo9.firewall-gateway.de 2->113 115 showip.net 2->115 117 44 other IPs or domains 2->117 135 Suricata IDS alerts for network traffic 2->135 137 Found malware configuration 2->137 139 Malicious sample detected (through community Yara rule) 2->139 141 26 other signatures 2->141 12 RFQ_QUOTATION  MTG-189-89791.pdf(93KB).com.exe 3 2->12         started        16 max.exe 2->16         started        18 javaw.exe 2->18         started        20 4 other processes 2->20 signatures3 process4 file5 109 RFQ_QUOTATION  MTG...f(93KB).com.exe.log, ASCII 12->109 dropped 181 Found many strings related to Crypto-Wallets (likely being stolen) 12->181 183 Injects a PE file into a foreign processes 12->183 22 RFQ_QUOTATION  MTG-189-89791.pdf(93KB).com.exe 1 12->22         started        185 Unusual module load detection (module proxying) 16->185 25 max.exe 16->25         started        187 Creates autostart registry keys to launch java 18->187 189 Creates multiple autostart registry keys 18->189 28 firefox.exe 20->28         started        31 max.exe 20->31         started        signatures6 process7 dnsIp8 163 Encrypted powershell cmdline option found 22->163 33 powershell.exe 18 22 22->33         started        105 C:\ProgramData\remcos\logs.dat, data 25->105 dropped 165 Maps a DLL or memory area into another process 25->165 167 Installs a global keyboard hook 25->167 127 mozilla.map.fastly.net 151.101.1.91, 443, 49786, 49803 FASTLYUS United States 28->127 107 C:\Users\user\AppData\...\gmpopenh264.dll.tmp, PE32+ 28->107 dropped 38 firefox.exe 28->38         started        file9 signatures10 process11 dnsIp12 111 igw.myfirewall.org 178.16.54.229, 49721, 49722, 80 DUSNET-ASDE Germany 33->111 91 C:\Users\user\AppData\Roaming\WORDS.exe, PE32 33->91 dropped 93 C:\Users\user\AppData\...\POWERPOINT.exe, PE32 33->93 dropped 95 C:\Users\user\AppData\Roaming\OUTLOOK.exe, PE32 33->95 dropped 97 3 other malicious files 33->97 dropped 143 Potential dropper URLs found in powershell memory 33->143 145 Powershell drops PE file 33->145 40 NOTEPAD.exe 3 33->40         started        43 WORDS.exe 33->43         started        45 POWERPOINT.exe 33->45         started        47 4 other processes 33->47 file13 signatures14 process15 dnsIp16 169 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 40->169 171 Found many strings related to Crypto-Wallets (likely being stolen) 40->171 173 Injects a PE file into a foreign processes 40->173 175 Switches to a custom stack to bypass stack traces 40->175 50 NOTEPAD.exe 40->50         started        54 cmd.exe 43->54         started        56 cmd.exe 43->56         started        59 POWERPOINT.exe 45->59         started        129 wqo9.firewall-gateway.de 91.92.241.145, 2404, 49728, 49787 THEZONEBG Bulgaria 47->129 177 Uses schtasks.exe or at.exe to add and modify task schedules 47->177 179 Document exploit detected (process start blacklist hit) 47->179 61 EXCEL.exe 47->61         started        63 OUTLOOK.exe 47->63         started        signatures17 process18 dnsIp19 119 mail.hsk-new.com 158.94.208.190, 25 JANETJiscServicesLimitedGB United Kingdom 50->119 121 icanhazip.com 104.16.185.241, 49783, 80 CLOUDFLARENETUS United States 50->121 147 System process connects to network (likely due to code injection or exploit) 50->147 149 Tries to steal Mail credentials (via file / registry access) 50->149 151 Creates multiple autostart registry keys 50->151 161 4 other signatures 50->161 81 3 other processes 50->81 153 Uses ping.exe to sleep 54->153 155 Uses ping.exe to check the status of other devices and networks 54->155 65 reg.exe 54->65         started        68 PING.EXE 54->68         started        71 conhost.exe 54->71         started        99 C:\Users\user\AppData\Roaming\max.exe, PE32 56->99 dropped 73 max.exe 56->73         started        75 conhost.exe 56->75         started        83 2 other processes 56->83 123 showip.net 162.55.60.2, 49729, 80 ACPCA United States 59->123 101 C:\Users\user\AppData\Roaming\...\firebed.exe, PE32 59->101 dropped 157 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 59->157 159 Tries to harvest and steal browser information (history, passwords, etc) 59->159 77 Notepadbook.exe 61->77         started        79 schtasks.exe 61->79         started        103 C:\Users\user\AppData\...\WindowsDefender.exe, PE32 63->103 dropped file20 signatures21 process22 dnsIp23 131 Creates multiple autostart registry keys 65->131 125 127.0.0.1 unknown unknown 68->125 133 Injects a PE file into a foreign processes 73->133 85 max.exe 73->85         started        87 Notepadbook.exe 77->87         started        89 conhost.exe 79->89         started        signatures24 process25
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/3ed85c60a5587bcf3c5c7cffd46c90491dfc3e3e74f91aac3f91c429a63c1792
Gathering data
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/3ed85c60a5587bcf3c5c7cffd46c90491dfc3e3e74f91aac3f91c429a63c1792/
Verdict:
Malicious
Threat:
Family.DARKCLOUD
Link:
https://tip.neiki.dev/file/3ed85c60a5587bcf3c5c7cffd46c90491dfc3e3e74f91aac3f91c429a63c1792
Threat name:
Win32.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-01-28 19:00:43 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=h3mfyyfflb546pc4pt75i3eqjeo7ypr6ot4rvlb7shcctjr4c6ja._file
Verdict:
malicious
Label(s):
unc_loader_078
Create hunting rule
Similar samples:
0e211c13ea627d3f7ae9023d2d7c1f972f56f8f0c0cd3cf3a52b2565d2e638ca
RemcosRAT
3ed85c60a5587bcf3c5c7cffd46c90491dfc3e3e74f91aac3f91c429a63c1792
RemcosRAT
b59f237069f8faccd2b47d23767c95ef269ea70bd910ad816728568afb9bec65
RemcosRAT
error
RemcosRAT
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:phantom_stealer family:quasar family:xworm botnet:spain2 collection defense_evasion discovery execution persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/260128-x2t54aaz8g/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Runs ping.exe
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
System Time Discovery
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Obfuscated Files or Information: Command Obfuscation
.NET Reactor proctector
Checks computer location settings
Drops startup file
Executes dropped EXE
Reads WinSCP keys stored on the system
Reads user/profile data of web browsers
Badlisted process makes network request
Downloads MZ/PE file
Detect Xworm Payload
Detects PhantomStealer payload
PhantomStealer
Phantom_stealer family
Quasar RAT
Quasar family
Quasar payload
Xworm
Xworm family
Malware Config
C2 Extraction:
rency.ydns.eu:59013
wqo9.firewall-gateway.de:59013
code1.ydns.eu:59013
twart.myfirewall.org:9792
rency.ydns.eu:5287
wqo9.firewall-gateway.de:8841
code1.ydns.eu:5287
wqo9.firewall-gateway.de:9792
Unpacked files
SH256 hash:
3ed85c60a5587bcf3c5c7cffd46c90491dfc3e3e74f91aac3f91c429a63c1792
MD5 hash:
6b921836f458d5df0e13f0681d987e6c
SHA1 hash:
b46651d72a79ee7b925961d51fc81272dc19f379
Link:
https://www.unpac.me/results/de2fbc09-9694-4b78-841f-19d871c9356e/
SH256 hash:
0ebdd6b8c242139f780a8b00abec958853237868b09de4bbf9dddc8b583da4f0
MD5 hash:
6e23b0cfefc115d31f8dac49b6379560
SHA1 hash:
234165f31d9f9d12dd286569f037fdf8fc42cfef
Link:
https://www.unpac.me/results/de2fbc09-9694-4b78-841f-19d871c9356e/
SH256 hash:
e8fd2ba3e6973d83e9d47a8a3927720d985116237b19ab98224b8c53e0501d71
MD5 hash:
4f844017df3330ccb00c2e4e2de4503b
SHA1 hash:
2fb551286b524bb9adf217efcffaf47b8efb98bf
Link:
https://www.unpac.me/results/de2fbc09-9694-4b78-841f-19d871c9356e/
SH256 hash:
fd7fb3258cf66e81004588e92d0716c2b958e11d58ec4cccdd34b707e2c629a5
MD5 hash:
c02c691102ab160e33c60e3309864755
SHA1 hash:
63d50f73a8c47fccdf27a076cb83ac4e4d90b45c
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
INDICATOR_EXE_Packed_DotNetReactor
Create hunting rule
Link:
https://www.unpac.me/results/de2fbc09-9694-4b78-841f-19d871c9356e/
Parent samples :
256b9eb0b0ef69eeee00712c0e9fab59601934633f2bb6d0a0b10ac04bd5b2ab
0e211c13ea627d3f7ae9023d2d7c1f972f56f8f0c0cd3cf3a52b2565d2e638ca
b6eb415d7b1be65850ede04ebe14006c319b11be80702c1d10ffd58a915a4f0f
b59f237069f8faccd2b47d23767c95ef269ea70bd910ad816728568afb9bec65
3ed85c60a5587bcf3c5c7cffd46c90491dfc3e3e74f91aac3f91c429a63c1792
67a9288baf5c274fae60465c54accb0973ea5e570c4eb992de3c5babc16b8dae
af45e7ab9d8c10b174c3ae27c54f39e69311c1716be6af42cc50eaaf96e29710
36d359de0808170809afdb8fa45e4403644de6eb4921eab83917d2952f3b6e2e
4abd169c2e8280b1e13b34af291b91138473bafd4b996ce020363f52371d77b6
43885d920258d6685b0896c6214b22b5c9f242b1ab76e75797abd91b09c52810
c3c30fc030de442cede5c078e0ba3ff227c4c57c10c23c4d7dba78e1147f3428
b5c87ae305492fcb39c332e34bb86cf96e0906d89eb7bedf552b740a877ca97d
cff9fc02dfb06bb740609505345e93c40b2b240734913b1122f2ca68a436bc2c
0cbb7f1b15b8cd50b8269b954738cbad9099994d60df5309ac5326c3886c3d10
8109a0528091c8be7fc71e941604672f1cfba50a020c9b4fce74be6e092764f4
65ca5368c87b5c53a24995aa3bb88240abf1766e2fd013ad10756e5006be286c
e53905be786890e707d3afe844cbb853b3b5db4f52768df923ac867a2659c3b1
897221ef7bedd400fc45ef4ebdb769c7993836942e77be5c5c34687eaf345bfc
8e428ed7bec47c35783cca6568a6a8f8d5229669d1cce764d30ecac9ff9c28d4
089e8cfc63b61fde5010b4f4b499e775a977c3b5015ad20679008bd13653d432
6314c3c82acb165b93aa922ff379754ea29c321d7a757a5d55d72e537072d9c7
31dca92bc5ec2f879df0ffaae3e1bdb9e047eb5ec3f6e902ef427bf67d579a20
9987ec2812cd79f25cd60af929f8d42abaf34ab3cfd54f56da6268805e401487
cfce046aff5060f8c73804dd97567df8326f3eab16fd907b1d7035c37f9c9f32
83c68b7f1cc15001fc5888f47553d8fbd3573dc8b83327ff778f63e7c5d3f079
15f90dcfd16ec3f33234533fc44c00d057ecb2f29682257baf061307ce321634
a0a642f5131f1d82cb91f1237deb6b0002b0e6f178d208295b5b7fe39cedb1d6
7419b292f77e62623a70a50d129c225c4d26fb53282f573f4e7f57242bbf946f
67be85e1d864a272c3ee117128c696d12e0528fe8d58a5a5749a7c157f525f08
e7cfccae222568b1fa4e94afc51ffe55260a4d9aa0deed412e1a2d0a9ce94e0c
1e92c5d7ad812ca338b0e85bf1decfa613ecb31376cf21888d45f474a06921af
4173909d6790cfde1cb60988ad573f014cf71b6bd7fe5ebc26a5284a429748c9
f1a8e538157bfb627e37f4da7ae8336f75d4e0a2aecc38eda2a141fa04547659
574fcf070fea538f31895cc5881fd74b796d9d5ec0d24cb524ae279661db0754
296663bffbaa720b1c857acf0cc46bec7355f1af1962f214e41a75cc5fe35817
53c4ecc82fbdc5f91d6a63ab46bbdef2241437719f4edd2c71318064ca5ebc5e
def6c1b31a71cb1325bdb0b286263d2d5ced9a24d213b0bceba824492d68d1c3
f2ddf3189b83629d36697f9337fbacdad5106024aeafb853f46e8f43042899bb
5a3dc333f94a982bc6e42f0b944880dcf8bdda1027e4be1f13c30dfe124b627b
44d7eb1fc0f09147291537db5d572d1960108376645c7ec2fe8f96e39f3de41d
a0b526925bb48806b6ea9abd3d7edae9097c315bd491c37ece9103b1471c1c5e
6b914bd021edae8935e2f9b5a9dd2a43aaf656e45d8b7ba3c751b863c8e9f636
5cf7d883f29fd1ef93f0f744413f97d419985587544d36b5326f7e8cd3828a66
338891872f9cfe7a363ee207f5aee7eeb72c5bbf8c88d6732ae28dff34ddc953
fae06bd8e10ad8ce681b472be4e42c6f6370edb154f2ce85b1c84f12c1084470
4d9d700211293b717f4f81e873e82fd57754ba880666ed1f214b67f4e0ac796e
53aefcb31cf737d2af9779bea562b358bb08c876bb68fbe5614c1084decb6728
cd467db145c02abd4b9954150dc878512c9029efd4374b9b1ff036733b6a6810
4e351a7ca7fb4a59daa108005a7a88c274d5893d7a490c48323f3ce42ab95acd
SH256 hash:
da59224e4a48584a44f7a7fb5a1eef8279ffcded8e9555ec65542b576f0029bc
MD5 hash:
b33d22178e1d02b4e362cc13f53f9ca7
SHA1 hash:
6b70062537fc956af90a359f4a289032e71a6db2
Link:
https://www.unpac.me/results/de2fbc09-9694-4b78-841f-19d871c9356e/
SH256 hash:
53d79d53b3a98df7a70208920bed4f441a3b9be0c619bc443101dde86e73df8f
MD5 hash:
d952b8212de3f4fe0ca0df24eff4582d
SHA1 hash:
856da76cb15173742d4ef0e4e880332cc3878829
Link:
https://www.unpac.me/results/de2fbc09-9694-4b78-841f-19d871c9356e/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/3ed85c60a558/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3ed85c60a5587bcf3c5c7cffd46c90491dfc3e3e74f91aac3f91c429a63c1792

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Executable exe 3ed85c60a5587bcf3c5c7cffd46c90491dfc3e3e74f91aac3f91c429a63c1792

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/50558/

Comments