MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 58421a1f4ace3bf3d22cc6133e1eee78253cebf89262eebe0d14423c4552a2c7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 3

Intelligence 3 IOCs YARA 2 File information Comments

SHA256 hash:	58421a1f4ace3bf3d22cc6133e1eee78253cebf89262eebe0d14423c4552a2c7
SHA3-384 hash:	45365a7b662aa14773fefb6584a81d74d36283c772c64f61a73c911b3b9e827c6e97e0fc9f58b568b60c09cb103d38c8
SHA1 hash:	5ffa8f5d9593d37e06f7c375a3481fd58f75bb36
MD5 hash:	114a85e912f3453e2ae5854f641bdf07
humanhash:	georgia-nitrogen-oxygen-beryllium
File name:	readme.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	1'054'722 bytes
First seen:	2020-05-04 22:18:42 UTC
Last seen:	2020-05-04 23:24:44 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	e453637f2317c3675b7b06b57403e87a (2 x RemcosRAT, 1 x GuLoader)
ssdeep	24576:8gTfvH5kDYtfLWyfhcEwyzdz5Ik5Zt5s4:8gTffS1sOcz5IM
Threatray	14 similar samples on MalwareBazaar
TLSH	7C257D22A253DA37C12355389D7F56B8E836BE136F6858472AF52C3C1EF93413837296
Reporter	abuse_ch
Tags:	exe RAT RemcosRAT UPS

abuse_ch

Malspam distributing RemcosRAT:

HELO: ours2.westcentralus.cloudapp.azure.com
Sending IP: 52.161.111.211
From: UPS Customer Service <customer@ups.com>
Subject: UPS - Pending delivery
Attachment: UPS_attachment.iso (contains "readme.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Variant.Zusy.302747.15832.15474.UNOFFICIAL

Gathering data

Threat name:

Win32.Trojan.Delf

Status:

Malicious

First seen:

2020-05-04 22:36:34 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

25 of 31 (80.65%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=lbbbuh2kzy57hurmyyjt4hxopastz27ysjro5pqncrbdyrksuldq._file

Verdict:

unknown

RemcosRAT

24d6774c1e91ab5d03b2bc857f8f35534acbc8f4ed8aaf802372588638100cb4

RemcosRAT

36e4352b2e4961e1ca1dd47baadf462af3e97fd0ebfb0c5694a5c6e22322c1c1

RemcosRAT

3ea4fb15ddf420fa1e6f2212145d84cf85e92c525d5ed25a8465a7c6c294878b

RemcosRAT

6e10d24d51ab300669a5980acfbb9589f16246ee81c6aab569fde0725390e1e1

RemcosRAT

73a0eff4b25b824af4b6600db0f637f991b45b0945c9385fd6e7eca289b7e5ed

RemcosRAT

a04de2a93ba5e718db28e8d9af7f89807841fd074bc00008238650504f68cdf7

RemcosRAT

b0d9f78957650a0bc42b0bf646e3d158f713de64ee5e6ab395cf777e93a7a240

RemcosRAT

eb9a70ac0d1f7c413f10f5308bda81e1da5a9b5bfd2ab7c8d89232eada71c143

RemcosRAT

fa7a1dd393f69a09e670d2a23f19ef272ad16083fdabeb705d9cadb4b1ff1977

RemcosRAT

+ 4 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

6/10

Tags:

n/a

Link:

https://tria.ge/reports/201109-3gj99jjwmn/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Legitimate hosting services abused for malware hosting/C2

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_RemcosRAT Create hunting rule
Author:	abuse.ch

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator