MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a354b88e0c8817b637120c95edcae262dd09c786e5b083072e5ea445031447c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 10

Intelligence 10 IOCs YARA 10 File information Comments

SHA256 hash:	4a354b88e0c8817b637120c95edcae262dd09c786e5b083072e5ea445031447c
SHA3-384 hash:	ed64feb1526d38a510bab6d7cdcb821e25405c78ab2d3962f3a8176ac9c9fd1bc4e6c5a90bb8f468998d199e48fb67f5
SHA1 hash:	edab18f838a9bfe439587e2846ba8658fd6b02ca
MD5 hash:	4919ea3a3f3e3ec9248ce16eb6f327a9
humanhash:	jupiter-washington-berlin-hydrogen
File name:	Original DHL BL_pdf.scr
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	65'536 bytes
First seen:	2020-12-22 10:36:32 UTC
Last seen:	2020-12-22 13:12:05 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	71ee61248f9a81cce45e093d8e987522 (3 x RemcosRAT)
ssdeep	768:xVSpIJeTWThypVrSyqK7+F2o2WUiKhthKh293Tfb+1d:DSpjCYpkAqF2obUHwhUTy
Threatray	2'926 similar samples on MalwareBazaar
TLSH	25533AC2EDB04930DC9906B418165B79025FBF20FD028A57EEC97F9E8476FC9992631E
Reporter	abuse_ch
Tags:	DHL GuLoader nVpn RAT RemcosRAT scr

abuse_ch

Malspam distributing RemcosRAT:

HELO: vps.jocmachinerys.com
Sending IP: 45.85.90.246
From: noreply@dhl.com <office@jocmachinerys.com>
Reply-To: swiftlogz@yandex.com
Subject: Re: Top Urgent Delivery on transit
Attachment: Original Shipping Documents.rar (contains "Original DHL BL_pdf.scr")

RemcosRAT C2:
wealth.freemyip.com:39777 (185.140.53.175)

Pointing to nVpn:

% Information related to '185.140.53.0 - 185.140.53.255'

% Abuse contact for '185.140.53.0 - 185.140.53.255' is 'abuse@privacyfirst.sh'

inetnum: 185.140.53.0 - 185.140.53.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-EU
country: EU
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2016-10-17T23:24:00Z
last-modified: 2020-11-06T23:02:44Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

456

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Original DHL BL_pdf.scr

Verdict:

Malicious activity

Analysis date:

2020-12-22 10:39:21 UTC

Tags:

rat remcos trojan keylogger stealer

Link:

https://app.any.run/tasks/bf7d3ecd-807a-472a-abb0-91fceed81b61

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Guloader

Link:

https://www.capesandbox.com/analysis/108708/

Detection(s):

SecuriteInfo.com.Artemis4919EA3A3F3E.5595.UNOFFICIAL

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Launching a process

Unauthorized injection to a recently created process by context flags manipulation

Result

Threat name:

Remcos GuLoader

Detection:

malicious

Classification:

rans.phis.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/568118

Signature

Contains functionality to hide a thread from the debugger

Hides threads from debuggers

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

May check the online IP address of the machine

Potential malicious icon found

Sigma detected: Remcos

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Instant Messenger accounts or passwords

Writes to foreign memory regions

Yara detected GuLoader

Yara detected VB6 Downloader Generic

Behaviour

Behavior Graph:

Download SVG

Detection:

remcos

Link:

https://mwdb.cert.pl/sample/4a354b88e0c8817b637120c95edcae262dd09c786e5b083072e5ea445031447c/

Threat name:

Win32.Trojan.Vebzenpak

Status:

Malicious

First seen:

2020-12-22 10:37:06 UTC

AV detection:

14 of 29 (48.28%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ji2uxchazcaxwy3redev5xfoeyw5bhdynznqqmds4xveiubrir6a._file

Verdict:

malicious

Label(s):

guloader

RemcosRAT

4576347a3a9ee138b98c0e500c1a0c1f662fbadc6629b9bba0c855016c97a1ef

RemcosRAT

6c7d10402361556d564ce74e16a05024a4e0ad31da03b98fb69d4f7c0079730f

RemcosRAT

988b22396032c7352be36c70d738091e7df261013cb1161194e8dc416fd15fe3

RemcosRAT

a49855a8a95f24d6ee35f5853e894f13be32bcc91bb076811feb3943f14bce6d

RemcosRAT

aa37bcba59760edc9f4242c1e6bb619c04d98c6d4b039fee3aee88bac894c21b

RemcosRAT

e15bdb0251ab0740aabcc3686ec2a65d9e10d1725b6713ccf868e85d1bc161bc

RemcosRAT

e45b4d0e0b338b2a3875466e875b008043acf8240da0d6caa2ec14d13c02fe41

RemcosRAT

e8f0dd4a951cb42729e34171301bf46bd708a8c1c1c0b5b7daf2ed9036b97cca

RemcosRAT

facb3b1bbd388588efa04a3d0a5ba963af70d863494dd180b876d590f8b1bb51

RemcosRAT

+ 2'916 additional samples on MalwareBazaar

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos rat upx

Link:

https://tria.ge/reports/201222-mk6dv84ple/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Legitimate hosting services abused for malware hosting/C2

UPX packed file

Remcos

Unpacked files

SH256 hash:

4a354b88e0c8817b637120c95edcae262dd09c786e5b083072e5ea445031447c

MD5 hash:

4919ea3a3f3e3ec9248ce16eb6f327a9

SHA1 hash:

edab18f838a9bfe439587e2846ba8658fd6b02ca

Link:

https://www.unpac.me/results/8cdc52b4-84e4-452e-93d2-fb5bc6dcdadc/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/4a354b88e0c8817b637120c95edcae262dd09c786e5b083072e5ea445031447c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_RemcosRAT Create hunting rule
Author:	abuse.ch

Rule name:	Chrome_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Chrome in files like avemaria

Rule name:	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer Create hunting rule
Author:	ditekSHen
Description:	detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Rule name:	Keylog_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Contains Keylog

Rule name:	Parallax Create hunting rule
Author:	@bartblaze
Description:	Identifies Parallax RAT.

Rule name:	Remcos Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Remcos in memory

Rule name:	remcos_rat Create hunting rule
Author:	jeFF0Falltrades

Rule name:	REMCOS_RAT_variants Create hunting rule

Rule name:	suspicious_packer_section Create hunting rule
Author:	@j0sm1
Description:	The packer/protector section names/keywords
Reference:	http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator