MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 62b2de7bb2bb84023725e04675fef0090998a2c96ec05fa40113c7f2c52e6562. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 8

Intelligence 8 IOCs YARA 9 File information Comments

SHA256 hash:	62b2de7bb2bb84023725e04675fef0090998a2c96ec05fa40113c7f2c52e6562
SHA3-384 hash:	aa1b25f80a441f801332060fd2e359b65766763c99027ed49df11e7dcf24a0d6a1ff8d45e8cbd6f445ebed8c466194c4
SHA1 hash:	cf5cf6625e42d443c51c64df1232cea1408d4372
MD5 hash:	15b0f7e4d6d3085d5dc9db5527882358
humanhash:	wyoming-single-pip-snake
File name:	Quiero hacer el pedido de su producto.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	1'012'224 bytes
First seen:	2021-01-18 16:25:37 UTC
Last seen:	2021-01-18 18:24:24 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'662 x AgentTesla, 19'477 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	24576:76ccx/qdJxXIR6fIwaPO3LSRTVeYrbzKctU5L:76didJx46bSNVeqzKc
TLSH	D0259D25139CDB21EBFC96F9A80141A073A9DE46F658F778D9B2B0D66835D2800DFF81
Reporter	abuse_ch
Tags:	ESP exe geo nVpn RAT RemcosRAT

abuse_ch

Malspam distributing RemcosRAT:

HELO: vps.asswart.com
Sending IP: 45.85.90.28
From: han.nguyen <han.nguyen@ascenti.com.vn>
Subject: Quiero hacer el pedido de su producto
Attachment: Quiero hacer el pedido de su producto.iso (contains "Quiero hacer el pedido de su producto.exe")

RemcosRAT C2:
mikegrace2021.ddns.net:1999 (185.244.30.18)

Pointing to nVpn:

% Information related to '185.244.30.0 - 185.244.30.255'

% Abuse contact for '185.244.30.0 - 185.244.30.255' is 'abuse@privacyfirst.sh'

inetnum: 185.244.30.0 - 185.244.30.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-HU
country: HU
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2019-10-29T14:10:27Z
last-modified: 2020-10-07T21:39:48Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

138

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Quiero hacer el pedido de su producto.exe

Verdict:

Suspicious activity

Analysis date:

2021-01-18 16:26:50 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/554cad4b-8821-4c39-8007-9fdc3cedd51a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/112597/

Detection(s):

SecuriteInfo.com.Variant.Ursu.157237.21511.19206.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Result

Threat name:

Remcos

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/584004

Signature

.NET source code contains potential unpacker

Contains functionality to capture and log keystrokes

Contains functionality to inject code into remote processes

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Detected Remcos RAT

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Sigma detected: Remcos

Sigma detected: Scheduled temp file as task from temp location

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses dynamic DNS services

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected AntiVM_3

Yara detected Remcos RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

remcos

Link:

https://mwdb.cert.pl/sample/62b2de7bb2bb84023725e04675fef0090998a2c96ec05fa40113c7f2c52e6562/

Threat name:

ByteCode-MSIL.Packed.Generic

Status:

Suspicious

First seen:

2021-01-18 16:26:08 UTC

AV detection:

15 of 44 (34.09%)

Threat level:

1/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=mkzn465sxocaenzf4bdhl7xqbeezriwjn3af7jabcpd7frjomvra._file

Verdict:

unknown

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos rat

Link:

https://tria.ge/reports/210118-4lj7c55ha2/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Remcos

Malware Config

C2 Extraction:

mikegrace2021.ddns.net:1999

Unpacked files

SH256 hash:

1d6ecf546163882d34d4bb2b7afa3889506ca3036ed536c4ed972ed89bdf5035

MD5 hash:

fb169513679d349cb2a7e4121bacfd4a

SHA1 hash:

26619d7ce0a175b9fc4fbfd7f4b105050562924f

Link:

https://www.unpac.me/results/37d87c38-3c81-4130-b149-9259b3474ce7/

SH256 hash:

62b2de7bb2bb84023725e04675fef0090998a2c96ec05fa40113c7f2c52e6562

MD5 hash:

15b0f7e4d6d3085d5dc9db5527882358

SHA1 hash:

cf5cf6625e42d443c51c64df1232cea1408d4372

Link:

https://www.unpac.me/results/37d87c38-3c81-4130-b149-9259b3474ce7/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.45

Link:

https://yomi.yoroi.company/submissions/62b2de7bb2bb84023725e04675fef0090998a2c96ec05fa40113c7f2c52e6562

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_RemcosRAT Create hunting rule
Author:	abuse.ch

Rule name:	Chrome_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Chrome in files like avemaria

Rule name:	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer Create hunting rule
Author:	ditekSHen
Description:	detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Rule name:	Keylog_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Contains Keylog

Rule name:	Parallax Create hunting rule
Author:	@bartblaze
Description:	Identifies Parallax RAT.

Rule name:	Remcos Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Remcos in memory

Rule name:	remcos_rat Create hunting rule
Author:	jeFF0Falltrades

Rule name:	REMCOS_RAT_variants Create hunting rule

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator