MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 54c937e5b6fe28e7076e549802765e15ad6191d2ddc427b532ff9347fef2eb39. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 10

Intelligence 10 IOCs YARA 2 File information Comments

SHA256 hash:	54c937e5b6fe28e7076e549802765e15ad6191d2ddc427b532ff9347fef2eb39
SHA3-384 hash:	c1eefd8552754f6d0a7c3ddad2c1bc25aadd14daab4a231d076aff581392cda599114de18e591236a99ae757cbe029b5
SHA1 hash:	2e750a9197ce55d6ec8256c97bec835f52f64ff1
MD5 hash:	ad9de147cb8b5f8d6d104d14785520a4
humanhash:	six-nevada-alpha-sink
File name:	Aui_TAM PI900007417864AP,pdf.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	523'264 bytes
First seen:	2020-08-06 06:56:16 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	6144:RJnRUmHw4kR1H++6hL33qKU4Yo8M33ns9+KvJhmickd+LRMu2P8CatjPHsrvROX:RfrHwBuLk2z33naXvfmicIg20
Threatray	1'183 similar samples on MalwareBazaar
TLSH	B8B4082461750697D7EC81B44F0C720449E39EB91A9EFAC5ECB73885F2B26B1672DC0B
Reporter	abuse_ch
Tags:	exe RAT RemcosRAT

abuse_ch

Malspam distributing RemcosRAT:

HELO: srv31.creattiva.cl
Sending IP: 200.35.157.31
From: Aui_TAM <pensr.k@thaiautomach.co.th>
Subject: RE: Aui_TAM PO237864
Attachment: Aui_TAM PI900007417864AP,pdf.iso (contains "Aui_TAM PI900007417864AP,pdf.exe")

RemcosRAT C2:
nagod1.ddns.net:8811

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Remcos

Link:

https://www.capesandbox.com/analysis/40214/

Detection(s):

SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Adding an access-denied ACE

Creating a file in the %temp% directory

Launching a process

Creating a process with a hidden window

Deleting a recently created file

Creating a file

DNS request

Connection attempt

Enabling autorun by creating a file

Unauthorized injection to a system process

Result

Threat name:

Remcos

Detection:

malicious

Classification:

rans.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/412362

Signature

Contains functionality to capture and log keystrokes

Contains functionality to inject code into remote processes

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Contains functionalty to change the wallpaper

Detected Remcos RAT

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Sigma detected: Remcos

Sigma detected: Scheduled temp file as task from temp location

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses dynamic DNS services

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Yara detected AntiVM_3

Yara detected Remcos RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

remcos

Link:

https://mwdb.cert.pl/sample/54c937e5b6fe28e7076e549802765e15ad6191d2ddc427b532ff9347fef2eb39/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-08-06 02:39:47 UTC

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ktetpznw7yuoob3oksmae5s6cwwwdeos3xccpnjs76jup7xs5m4q._file

Verdict:

malicious

Label(s):

remcos

RemcosRAT

23486053a77b3b37f7323a6bd6941ec13d341fc553bcb0675b475cef4392c894

RemcosRAT

327bc1ad9fc793811e5da6cb3553b7dca05c8a48d8060fc94015339ee805851d

RemcosRAT

749b5bf46ac62e2f4c947f36095ef8e1277d36771f41a289a6a6c852972489d8

RemcosRAT

8d2c8e9d03cb9dc2768d7bd74bd5f78905dc49cd59d811b278e291f1a7519a5b

RemcosRAT

a70a683c541f11a78b9f07bf9e11d8f0f593cd7795fa213b3c1db17c284ee4dc

RemcosRAT

b1135688496020eb3e075121b22fb9c726c6021068ce415be82d8e48540dc563

RemcosRAT

d3da8a5db05b801ccfadb4d396327f9bc10b616ac2cc89f197552a23f7044dee

RemcosRAT

d99680b269d345d0e78e80b5310077f35e781ab5e74a1f926cb0be47d185a9c4

RemcosRAT

df55898a2e3ad76e9ca691d178e15d2c499f391be7ed604a10ea7084e02d9446

RemcosRAT

+ 1'173 additional samples on MalwareBazaar

Result

Malware family:

remcos

Score:

10/10

Tags:

rat family:remcos

Link:

https://tria.ge/reports/200806-7jjql7xtta/

Behaviour

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Suspicious use of SetThreadContext

Uses the VBS compiler for execution

Remcos

Malware Config

C2 Extraction:

nagod1.ddns.net:8811

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/54c937e5b6fe28e7076e549802765e15ad6191d2ddc427b532ff9347fef2eb39

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_RemcosRAT Create hunting rule
Author:	abuse.ch

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator