MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4444f1da7f9b30eb4fb593b9492e42745332402980e118b6a0431c7d1f5670ce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	4444f1da7f9b30eb4fb593b9492e42745332402980e118b6a0431c7d1f5670ce
SHA3-384 hash:	5d8e01389b372a07abda7a0966884d987e43a6dbd64370c1a37355beb1d3efe1bdc4d7391b2fb205449e2b3e9854908c
SHA1 hash:	28fd21058e88cd0e77cc9da119c7b7ecd582e2ac
MD5 hash:	c088802b03e3bc1ef0082f268847a5f7
humanhash:	berlin-maine-sink-lake
File name:	remcos.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	665'088 bytes
First seen:	2020-07-09 00:35:27 UTC
Last seen:	2020-07-09 01:57:00 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	c769aa33458940b0c0e3838f7c635f27 (4 x RemcosRAT, 3 x FormBook, 1 x AveMariaRAT)
ssdeep	12288:71uSw3tWopwOdOGakJ1olUL+zUQJ75w0nGas4qDaitL8ST:7kx308tOGakJ1gh4QJdw0G9vDaML8ST
Threatray	891 similar samples on MalwareBazaar
TLSH	3FE47D52F6C09877D02B1A7DCC5FD664683ABE152D24D84A3AE67E0C4EF6341343B29B
Reporter	theDark3d
Tags:	exe remcos RemcosRAT

Intelligence

File Origin

# of uploads :

# of downloads :

120

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/23362/

Detection(s):

PUA.Win.Adware.Slugin-6803969-0

PUA.Win.Adware.Slugin-6840354-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

DNS request

Sending a custom TCP request

Launching the default Windows debugger (dwwin.exe)

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4444f1da7f9b30eb4fb593b9492e42745332402980e118b6a0431c7d1f5670ce/

Threat name:

Win32.Trojan.Wacatac

Status:

Malicious

First seen:

2020-07-08 11:06:59 UTC

AV detection:

26 of 29 (89.66%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ircpdwt7tmyowt5vso4uslscorjteqbjqdqrrnvaimoh2h2wodha._file

Verdict:

malicious

Label(s):

remcos

RemcosRAT

46f44909e841bd865bdebedd53ce89131ab3f50ba949953890d797c7aa041ab5

RemcosRAT

491cff43b259addd44a312094b15674d2c33c9ab901500130fead03e7d9d6530

RemcosRAT

6916d0f41d35a9142e598496a1e996616b4fad6d15f0f3da7ec9210b6a124586

RemcosRAT

8bbb8fe69100550248f4663e911a16bca03432bef9112dd0924d7a9c3dae8464

RemcosRAT

a486d1f0ad1fb2729dbbcd5d3606f30566f86abd3f2d5218c11077dfeac95f0e

RemcosRAT

c046bdf5af7c66114243efcb5f6d33a96456134077dbcf068bf748f3f0229a19

RemcosRAT

c10cdf38e26339e4373c7e0a9a119381e703c7b8404ce0ed694fb3aae286d9b9

RemcosRAT

db4bb50f2327328901cc6fff050acb653a059dc905917dcefedccbd8154c13ce

RemcosRAT

f8185c5af3e891bdb81a646bb410777393f7ba6db6f4fc0727948c4b95264334

RemcosRAT

+ 881 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

8/10

Tags:

persistence

Link:

https://tria.ge/reports/200709-16x681dfk2/

Behaviour

Modifies registry key

Suspicious use of WriteProcessMemory

Adds Run entry to start application

Legitimate hosting services abused for malware hosting/C2

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator