MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5cd183da8ceb32dfce5219ece25684d9eb1624ca8e0ec30e374219732944c8e5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5cd183da8ceb32dfce5219ece25684d9eb1624ca8e0ec30e374219732944c8e5
SHA3-384 hash: 27526cfb14a4ea500cd3f3a6958b716198a7e1e74c7cce93e37189c4306d1ec23d40ab7963051f2adccd5d560da4a51b
SHA1 hash: b46eb569d352fe5dc0cc5c3f67fe6474a09a514f
MD5 hash: 7de6d9395aafb8bd1720692f8c3e8397
humanhash: hot-magnesium-hot-hotel
File name:ISF form == 20030316 M#EGLV003090032432.scr
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:598'528 bytes
First seen:2020-05-14 06:47:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1e4b6b1798d0c6be9e09f9012364ba1c (6 x AgentTesla, 3 x FormBook, 2 x Loki)
ssdeep 12288:1wFPGxJDbawx1fVc+yjaUP6tplMw797fCbTaFn5vwIHQa8k7Q/+:1wNMJ6wBuTMlM8JYO15IIwasG
Threatray 784 similar samples on MalwareBazaar
TLSH 3DD49E26F2D04B32C16315388C4B5B6C9836BE00392B9D46EBEB1D4DAF3778179E6197
Reporter abuse_ch
Tags:RAT RemcosRAT scr


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: mail.genogan.ga
Sending IP: 89.36.212.88
From: Emily@fatton.com.tw <emily@fatton.com.tw> <admin@genogan.ga>
Subject: ==ISF form == 20030316 /M#EGLV003090032432 / ==AMD HBL+MBL ETD: 6/03 SO B498+499 (LCL FROM TAICHUNG TO LA)
Attachment: ISF form == 20030316 MEGLV003090032432.zip (contains "ISF form == 20030316 M#EGLV003090032432.scr")

RemcosRAT C2:
188.72.124.143:2858

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Adware.Generic4.AANW.UNOFFICIAL
Create hunting rule

PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-14 07:31:57 UTC
File Type:
PE (Exe)
Extracted files:
317
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ltiyhwum5mzn7tssdhwoevue3hvrmjgkryhmgdrxiimxgkkezdsq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
035eaa4837d35a30fff60618e860e93811e6ad310ff606b65c3ccd71b78232cd
RemcosRAT
39b6534e71eea7f25cd242cbeec0e465b211f8cd453172f284feac37ae8c973d
RemcosRAT
56a559cba0b0d2eef43c8d32d4b2a2710fb04f1c3f18dd65ddebdcdf3ee4e89d
RemcosRAT
6895305f9210132874ed3a348dbf1ee637994533f5bb8cff2eaae83da810e4dd
RemcosRAT
97dd79655e302fc504c36a27eef5b5bc385b42976b9db47c359e81d00eadecf8
RemcosRAT
b2f999593d2004d1ea8797e0d1a20096b204e5211d1b39b5e4998e7835555e41
RemcosRAT
b362bb2946e02fd0ef8c7a7b186ac41ce12c2c71e798b0a31e16fbfd0c83d958
RemcosRAT
e1b4622454cead31c14bd55cf1985eb6b5e93483989b183cf32e79e07ee4dc13
RemcosRAT
ea5f7ceccf5540860f32abe23534330ccb4b5b082d94b2afb5aa1e6d26a1ae56
RemcosRAT
f89c8debd5a5759bd372622cf7be54424d5e87c8b8246fb44835ea94d1f72bad
RemcosRAT
+ 774 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos evasion persistence rat trojan
Link:
https://tria.ge/reports/201109-wpss4ne9a6/
Behaviour
Modifies registry key
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Modifies registry class
Suspicious use of AdjustPrivilegeToken
Program crash
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
ServiceHost packer
Remcos
UAC bypass
Malware Config
C2 Extraction:
188.72.124.143:2858
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_RemcosRAT
Create hunting rule
Author:abuse.ch
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip 4767c646c40f6ceace8139de145a631a308ae5c3fe3f2868bd36477009920446

RemcosRAT

Executable exe 5cd183da8ceb32dfce5219ece25684d9eb1624ca8e0ec30e374219732944c8e5

(this sample)

  
Dropped by
MD5 4616f486e2142fb7488719f2e132edaf
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 4767c646c40f6ceace8139de145a631a308ae5c3fe3f2868bd36477009920446

Comments