MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 46f35b1a4610db31f2e95f75c60a7cbebde0e27c81dbf9e529424d30d74e446a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RemcosRAT
Vendor detections: 3
| SHA256 hash: | 46f35b1a4610db31f2e95f75c60a7cbebde0e27c81dbf9e529424d30d74e446a |
|---|---|
| SHA3-384 hash: | d9262ed09d2e5f769c61ff7756eda455307ba6a9a858c92e38e364aaea4574daff07e04f3aa379fbc590b3e126b78c8e |
| SHA1 hash: | 9723261d4593d992e890431e8090b86e90039e49 |
| MD5 hash: | 833f4b238c999370ea9633a35700bc25 |
| humanhash: | fix-enemy-maryland-october |
| File name: | 833f4b238c999370ea9633a35700bc25.exe |
| Download: | download sample |
| Signature | RemcosRAT |
| File size: | 253'440 bytes |
| First seen: | 2020-04-30 15:41:31 UTC |
| Last seen: | 2020-04-30 16:38:56 UTC |
| File type: |  dll |
| MIME type: | application/x-dosexec |
| imphash | d54856e90bade24074537e8303268776 (1 x RemcosRAT) |
| ssdeep | 6144:pSb2lCqrKiaECkLcy/5R6csaV4iQhJs9HcQip0wBPUY:HQIza6Ay/ur8QPXQiPVn |
| Threatray | 899 similar samples on MalwareBazaar |
| TLSH | EF44E027E8C18073D1526AFC8D0A92C5F53EFE263E54156F7ADE2D4A4FEE281146C4D2 |
| Reporter |  abuse_ch |
| Tags: | exe GuLoader RemcosRAT |
abuse_ch
Payload dropped by GuLoader from the following URL:daolnwod=tropxe&VtUr7knlJ5Pj89AYF4KlBv1YDJvfrjSo1=di?cu/0/u/moc.elgoog.evird//:sptth
Intelligence
File Origin
# of uploads :
2
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Status:
Malicious
First seen:
2020-04-30 16:35:21 UTC
File Type:
PE (Dll)
AV detection:
27 of 31 (87.10%)
Threat level:
2/5
Verdict:
malicious
Label(s):
remcos
Similar samples:
+ 889 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
6fbaf9402543c0c265323de678a06d12e7461f9012c1a710bf2dd6b1f8ac9dc8
Dropped by
MD5 b5db8497457fd0eca723240a2f565396
Dropped by
GuLoader
Dropped by
SHA256 6fbaf9402543c0c265323de678a06d12e7461f9012c1a710bf2dd6b1f8ac9dc8
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_NX | Missing Non-Executable Memory Protection | critical |
| CHECK_PIE | Missing Position-Independent Executable (PIE) Protection | high |
Reviews
| ID | Capabilities | Evidence |
|---|---|---|
| SHELL_API | Manipulates System Shell | shell32.dll::ShellExecuteA |
| URL_MONIKERS_API | Can Download & Execute components | URLMON.DLL::URLDownloadToFileA |
| WIN32_PROCESS_API | Can Create Process and Threads | kernel32.dll::CreateRemoteThread kernel32.dll::CreateProcessA kernel32.dll::VirtualAllocEx kernel32.dll::WriteProcessMemory kernel32.dll::CloseHandle |
| WIN_BASE_API | Uses Win Base API | kernel32.dll::LoadLibraryExA kernel32.dll::LoadLibraryA kernel32.dll::GetStartupInfoA kernel32.dll::GetDiskFreeSpaceA kernel32.dll::GetCommandLineA |
| WIN_BASE_IO_API | Can Create Files | kernel32.dll::CreateDirectoryA kernel32.dll::CreateFileA kernel32.dll::DeleteFileA kernel32.dll::GetFileAttributesA kernel32.dll::FindFirstFileA |
| WIN_REG_API | Can Manipulate Windows Registry | advapi32.dll::RegCreateKeyExA advapi32.dll::RegOpenKeyExA advapi32.dll::RegQueryValueExA advapi32.dll::RegSetValueExA |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.