MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a9558166c80c188e48a382edbe91a387a7e3aa877d035420bb0e7b198eccdfe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 10

Intelligence 10 IOCs YARA 10 File information Comments

SHA256 hash:	4a9558166c80c188e48a382edbe91a387a7e3aa877d035420bb0e7b198eccdfe
SHA3-384 hash:	31f2d17bd108661e47a82fdd84cec1ee06a3343280f928fbea8d5b507ad60f048d86a19244813bb597fe4b8619257cf4
SHA1 hash:	76c66d778be3864b3620bb1e549f829cb3a0aa71
MD5 hash:	f4377760dfdf30c23903595e8d50d624
humanhash:	don-item-fish-oxygen
File name:	POEA ADVISORY ON DELISTED AGENCIES.PDF.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	532'992 bytes
First seen:	2021-02-22 06:38:02 UTC
Last seen:	2021-02-23 15:29:59 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep	6144:pCtlnyWI+6CaaXSzMwFr43Wjy8Fg2GBglZn7wIGyuPENWKOSr2A3B+mKKCFNEENA:elnEJozGu8bAc7FUENeSFRZmXwSM7Pj
Threatray	10 similar samples on MalwareBazaar
TLSH	21B4126512E86B16F83E87F0947051403BB67D5AA876F26D1FC920EF09B1F7191E2B23
Reporter	abuse_ch
Tags:	exe RAT RemcosRAT

abuse_ch

Malspam distributing RemcosRAT:

HELO: sd.latticesystems.com
Sending IP: 204.152.206.90
From: ksa.Consulate manila <consulate_ksa_emb@gmail.com>
Subject: Memorandum
Attachment: POEA ADVISORY ON DELISTED AGENCIES.uue (contains "POEA ADVISORY ON DELISTED AGENCIES.PDF.exe")

RemcosRAT C2:
shahzad73.casacam.net:2404

Intelligence

File Origin

# of uploads :

# of downloads :

106

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Remcos

Link:

https://www.capesandbox.com/analysis/118185/

Detection(s):

SecuriteInfo.com.Trojan.Packed2.42850.3560.10858.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Creating a file in the %AppData% directory

Creating a file in the %temp% directory

Launching a process

Creating a process with a hidden window

Deleting a recently created file

Unauthorized injection to a recently created process

Creating a file

DNS request

Sending a custom TCP request

Creating a file in the %AppData% subdirectories

Setting a global event handler for the keyboard

Enabling autorun by creating a file

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Remcos

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/613651

Signature

Binary contains a suspicious time stamp

C2 URLs / IPs found in malware configuration

Contains functionality to capture and log keystrokes

Contains functionality to inject code into remote processes

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Detected Remcos RAT

Found malware configuration

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Remcos

Sigma detected: Scheduled temp file as task from temp location

Sigma detected: Suspicious Double Extension

Uses an obfuscated file name to hide its real file extension (double extension)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Remcos RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

remcos

Link:

https://mwdb.cert.pl/sample/4a9558166c80c188e48a382edbe91a387a7e3aa877d035420bb0e7b198eccdfe/

Threat name:

Win32.Trojan.Generic

Status:

Suspicious

First seen:

2021-02-22 04:22:47 UTC

AV detection:

6 of 47 (12.77%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=jkkvqftmqdayrzekhaxnx2i2hb5h4ovio7idkqqlwdt3dghmzx7a._file

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos rat

Link:

https://tria.ge/reports/210222-znjapyw1m2/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Remcos

Malware Config

C2 Extraction:

shahzad73.casacam.net:2404
shahzad73.ddns.net:2404

Unpacked files

SH256 hash:

5bca2dc9bc6d9c1e363297a4f7b08fde8a144f13bd10407d6b7dd2f6c24ecd16

MD5 hash:

27000cadbf019932a73f530d02e7db8f

SHA1 hash:

fcb6c035f6fb03a2391e330f9bad700789befa30

Link:

https://www.unpac.me/results/02d6eedd-26eb-44e4-9b1d-2e25a84cfb06/

SH256 hash:

260900d7f061400a015ef8100be9d45efd1b51c7a486a85cb989bdd889949d95

MD5 hash:

78421250b4c7d6ec5032618369beb02e

SHA1 hash:

7bb7a5f65e80a8cd5f686024b4c202be78886b6f

Detections:

win_remcos_g0

win_remcos_auto

Link:

https://www.unpac.me/results/02d6eedd-26eb-44e4-9b1d-2e25a84cfb06/

Parent samples :

0bfae38c37f8478cfd4c92f603b202f8f4bff11f96fdce5959eeaad5142d9a3a
abb4163c6b54005775d4b62e00a5a8fd403c4fa474380935ac4d311058341e51
4a9558166c80c188e48a382edbe91a387a7e3aa877d035420bb0e7b198eccdfe
d8d0fa0edc24a3f45c735569b2ff8b407f69b3c309775e33b08c08c295177b42
58da120970be7bbf194aa12c38b56f7542174f1672b103d695cc262c6d90f18a

SH256 hash:

f0a09c48af16c079c37ad0914f18897976357981fe5ee6f556ab9f9f70b9a671

MD5 hash:

f984a71581f6da5732110be2a569a392

SHA1 hash:

10de05b6b35fc5dbc00c42d59a4b850bcaae01e6

Link:

https://www.unpac.me/results/02d6eedd-26eb-44e4-9b1d-2e25a84cfb06/

SH256 hash:

4a9558166c80c188e48a382edbe91a387a7e3aa877d035420bb0e7b198eccdfe

MD5 hash:

f4377760dfdf30c23903595e8d50d624

SHA1 hash:

76c66d778be3864b3620bb1e549f829cb3a0aa71

Link:

https://www.unpac.me/results/02d6eedd-26eb-44e4-9b1d-2e25a84cfb06/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_RemcosRAT Create hunting rule
Author:	abuse.ch

Rule name:	Chrome_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Chrome in files like avemaria

Rule name:	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer Create hunting rule
Author:	ditekSHen
Description:	detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time

Rule name:	Keylog_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Contains Keylog

Rule name:	Parallax Create hunting rule
Author:	@bartblaze
Description:	Identifies Parallax RAT.

Rule name:	Remcos Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Remcos in memory

Rule name:	remcos_rat Create hunting rule
Author:	jeFF0Falltrades

Rule name:	REMCOS_RAT_variants Create hunting rule

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator