MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 61feaac6ffb4031baff62a70bf36a38e69e849685c1e3edfe0ddbbfe220abd7a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 10

Intelligence 10 IOCs YARA 6 File information Comments

SHA256 hash:	61feaac6ffb4031baff62a70bf36a38e69e849685c1e3edfe0ddbbfe220abd7a
SHA3-384 hash:	ce002239211990108efd596955a46217881395d8fc68c9ec541d5d3b7e4645d7198aa6dc29320a281e610720966a8c85
SHA1 hash:	1ca4e3d2bfdb686128974b4b72fb9e65a2858137
MD5 hash:	08bdaecd7993a0ac1b9864cc01f6cc96
humanhash:	nuts-oregon-alaska-nebraska
File name:	08bdaecd7993a0ac1b9864cc01f6cc96.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	427'520 bytes
First seen:	2020-10-23 11:43:40 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	12288:EFDgWRK9wINs5YlFbWMzGC+Kz95LJuCKRf3CR:EZvRK95ZTrzB9tJgRf
Threatray	943 similar samples on MalwareBazaar
TLSH	5394013C122DCCDEC78E0679E871472CD7F498863201CDA97B46E98EB9A77C2314A9D5
Reporter	abuse_ch
Tags:	exe RAT RemcosRAT

abuse_ch

RemcosRAT C2:
ndma.chickenkiller.com:24311 (185.189.112.27)

Intelligence

File Origin

# of uploads :

# of downloads :

116

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Remcos

Link:

https://www.capesandbox.com/analysis/75038/

Detection(s):

SecuriteInfo.com.Artemis08BDAECD7993.6231.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Launching a process

Creating a file

DNS request

Sending a TCP request to an infection source

Unauthorized injection to a system process

Result

Threat name:

Remcos

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/508080

Signature

Contains functionality to capture and log keystrokes

Contains functionality to inject code into remote processes

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Detected Remcos RAT

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Sigma detected: Remcos

Writes to foreign memory regions

Yara detected Remcos RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/61feaac6ffb4031baff62a70bf36a38e69e849685c1e3edfe0ddbbfe220abd7a/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-10-23 11:45:06 UTC

AV detection:

22 of 29 (75.86%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=mh7kvrx7wqbrxl7wfjyl6nvdrzu6qslilqpd5x7a3w574iqkxv5a._file

Verdict:

malicious

Label(s):

remcos

RemcosRAT

257b2b1a5694438c684e9d4fd44141fc3f09a18d15ebef5e46aad1603afa0b0c

RemcosRAT

2aca994114835d2663353454df341285535994068284d9cbbb03e2e87f388b80

RemcosRAT

3270cfe3f15d8303d43e64e082d89eabb0737af61637393ed6d4922c3cba3909

RemcosRAT

3569d46f24fc262031aad2932c38bf1347420472f197628c622a45e6b061ca76

RemcosRAT

5a418e084b49b740a94d307baf45d67ac25db462fdeb80065fb60ffeb197273f

RemcosRAT

5c9667b60610ff2eeb6b26096b7ac951ed3d59fc716a6b8aa1c94c38658b0db7

RemcosRAT

6637c089017af9c448d8235e20db32603d8547f0611187341cf184dc66c170b4

RemcosRAT

95167e64d46e5f0e9821b379aa7e412f57d14fe11e613bdcab38cb47dc217bbc

RemcosRAT

e037b5ebac7b3ac81b3e268268dbd072784c73f178662e4a66e5e57d7e8a67c3

RemcosRAT

+ 933 additional samples on MalwareBazaar

Result

Malware family:

remcos

Score:

10/10

Tags:

rat family:remcos

Link:

https://tria.ge/reports/201023-m5hs3g18ns/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Remcos

Malware Config

C2 Extraction:

ndma.chickenkiller.com:24311

Unpacked files

SH256 hash:

7bdbb8ef643ad7b42418ce8a8fae2cbd61be6ade76b68a658c7650441f88de13

MD5 hash:

bf8c968b2698aac3de88acf5cd2d005f

SHA1 hash:

05be6c7a1004924cc1eefc83d2b303fae412fa9d

Link:

https://www.unpac.me/results/f680006e-893a-422b-b93d-c6f42f358fe2/

SH256 hash:

cc6357f48f4846e3142d547ef204a71476f78d96e6be6baccd9f678410460b8e

MD5 hash:

7eb34e4104629004c23f49c7d1d10942

SHA1 hash:

89cbb80a1d3f8b8d82293689880778ca4c6fd58c

Detections:

win_remcos_g0

win_remcos_auto

Link:

https://www.unpac.me/results/f680006e-893a-422b-b93d-c6f42f358fe2/

SH256 hash:

61feaac6ffb4031baff62a70bf36a38e69e849685c1e3edfe0ddbbfe220abd7a

MD5 hash:

08bdaecd7993a0ac1b9864cc01f6cc96

SHA1 hash:

1ca4e3d2bfdb686128974b4b72fb9e65a2858137

Link:

https://www.unpac.me/results/f680006e-893a-422b-b93d-c6f42f358fe2/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Remcos

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/61feaac6ffb4031baff62a70bf36a38e69e849685c1e3edfe0ddbbfe220abd7a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_RemcosRAT Create hunting rule
Author:	abuse.ch

Rule name:	Chrome_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Chrome in files like avemaria

Rule name:	Keylog_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Contains Keylog

Rule name:	Parallax Create hunting rule
Author:	@bartblaze
Description:	Identifies Parallax RAT.

Rule name:	Remcos Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Remcos in memory

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator