MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 426d3af918c60fbc12206aa3bc31f47c30f16b69cb7ff8f8de1d381270e12a36. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 426d3af918c60fbc12206aa3bc31f47c30f16b69cb7ff8f8de1d381270e12a36
SHA3-384 hash: 219cfd30274b80f442daf28d7564b0b54d33a24cc2aa02d0dda815731b70997785593ab535870843c1aaa2faf0150027
SHA1 hash: 4f01a610219cf9a409b7393742aca1da34593bb7
MD5 hash: d6dc3afd4a99d269489b77bd4160a886
humanhash: maine-zebra-lemon-indigo
File name:NEW PO (PO#HD512-6 5700)12.zip
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:964'275 bytes
First seen:2021-04-15 08:55:01 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:hHp3DAVQAgBtm3napuMxc3JXIlM4qswIHSsZ3QoYNNV:hJ3qQLoXLvlVsRlY7V
TLSH D325338DA510409F834907123E4EAD939F51A633D9603CA01EF1677B99BCABCA9C7C5F
Reporter GovCERT_CH
Tags:RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
308
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.658.23693.16463.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/426d3af918c60fbc12206aa3bc31f47c30f16b69cb7ff8f8de1d381270e12a36
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/426d3af918c60fbc12206aa3bc31f47c30f16b69cb7ff8f8de1d381270e12a36/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-15 08:55:17 UTC
AV detection:
10 of 47 (21.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ijwtv6iyyyh3yerankr3ympupqypc23jzn77r6g6du4be4hbfi3a._file
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos rat
Link:
https://tria.ge/reports/210415-kprm6753lx/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Remcos
Malware Config
C2 Extraction:
103.89.88.238:4292
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/426d3af918c60fbc12206aa3bc31f47c30f16b69cb7ff8f8de1d381270e12a36

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip 426d3af918c60fbc12206aa3bc31f47c30f16b69cb7ff8f8de1d381270e12a36

(this sample)

RemcosRAT

Executable exe 8017cf230cb7f4e72b6128a7e696821749c4990dbd446f8206d948c3ed6530ec

  
Dropped by
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8017cf230cb7f4e72b6128a7e696821749c4990dbd446f8206d948c3ed6530ec
  
Dropping
MD5 7c96cee7f960df295f0f3c7c7712db1c

Comments