MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 663921e0ebe32e8c57da404739f780f14ce4e9a86c13d47530e25649df2324d8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 3

Intelligence 3 IOCs YARA 2 File information Comments

SHA256 hash:	663921e0ebe32e8c57da404739f780f14ce4e9a86c13d47530e25649df2324d8
SHA3-384 hash:	bb2e2f2e608701555accc7a6a80cb3000d70de41ff932707f2f42a7cc0ebffb95fd264335eb3c9d6490d3fe2a810aeee
SHA1 hash:	28268295cc4cf86bcd08e9d52fac4474f314a8f0
MD5 hash:	13902b68f0a2e0668f7ab0835892a171
humanhash:	don-double-earth-sodium
File name:	Formal PO # POWN200303885GSN,pdf.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	920'064 bytes
First seen:	2020-05-19 06:09:29 UTC
Last seen:	2020-05-19 07:12:37 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	a60eeb16c5e8e15ff22c79959616ed49 (4 x RemcosRAT)
ssdeep	12288:7dvX6zWt8YVrL4fjlkNhIvgwGHd3jxv9A7BwkItGkWtK+Zd2QOf4yDA4B3Gc6pOP:78qEfyIFGHFls4tYj+Rko2XpONR08
Threatray	114 similar samples on MalwareBazaar
TLSH	81157D62F2D08433C123297D9D1B97A49D3ABE613E542C467BE86D8C4F3E792343A197
Reporter	abuse_ch
Tags:	exe RAT RemcosRAT

abuse_ch

Malspam distributing RemcosRAT:

HELO: fenix.gigabits.cl
Sending IP: 186.67.77.198
From: Nelly Juarez Reyes <orders@assaymatrix.com>
Subject: RE: Formal PO # POWN200303885/GSN
Attachment: Formal PO POWN200303885GSN,pdf.iso (contains "Formal PO # POWN200303885GSN,pdf.exe")

RemcosRAT C2:
nagod.ddns.net (216.38.7.231)

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

PUA.Win.Packer.BorlandDelphi-15

PUA.Win.Adware.Slugin-6803969-0

PUA.Win.Adware.Slugin-6840354-0

Gathering data

Threat name:

Win32.Downloader.Delf

Status:

Malicious

First seen:

2020-05-19 06:36:50 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

25 of 48 (52.08%)

Threat level:

3/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=my4sdyhl4mxiyv62ibdtt54a6fgoj2ninqj5i5jq4jletxzdetma._file

Verdict:

suspicious

RemcosRAT

06c3086d2a9a4456f1e98b32ce177c455ed82caf13ae4bdc2e402d78f566160c

RemcosRAT

3484fffe14e6d045c8a5c568187f686d4479693dadb3fc4631b7d307000b5148

RemcosRAT

4d993cb21ffe5a2b315ceede2a9e021f65fba6df052e1d0a400afba3ba76c17a

RemcosRAT

5e499f9a72195ce2d1d2e0ca6dffbacc880ae5bc0847ea03e65060c993e35146

RemcosRAT

654dcb8cbaca77d6679523c36f44ea656e39a97ce7e4d6f91b089fe8d54f9787

RemcosRAT

6bd678bf71a6b8c33bd6b03d2559ee5e43fef7b6449d48962a2c4032ce7a8138

RemcosRAT

d451ccbf03a26ade8ebf9ac8ab623025dd3148b45dd1bfc85e5761e13226308d

RemcosRAT

e24298b174f7e0ac0ff54e424e20981739f31d285969d829dfb0b7b95272b7d6

RemcosRAT

f6b725654c8d666688aaa90def223e8592a17110aead0e275c35c64e18c10985

RemcosRAT

+ 104 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

6/10

Tags:

n/a

Link:

https://tria.ge/reports/201109-erch5p6njs/

Behaviour

Script User-Agent

Legitimate hosting services abused for malware hosting/C2

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_RemcosRAT Create hunting rule
Author:	abuse.ch

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator