MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6d833bd671f179c8dfdf89aac0bc77cd7bb49f82a98cbf5d8122a9d47fa98e9f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6d833bd671f179c8dfdf89aac0bc77cd7bb49f82a98cbf5d8122a9d47fa98e9f
SHA3-384 hash: 32db5a8df366d07b54a91d19e322d8337de07e1937904eb867aad1bca27fc598654cc153ac121c6771bcb5fc813ea7ba
SHA1 hash: 524420700c00803f30d358c16a3417ff61180c56
MD5 hash: af0dcc7be12b7d64330063fd54f51626
humanhash: delta-uncle-beryllium-bluebird
File name:DELISTED MANNING AGENCIES.PDF.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:928'249 bytes
First seen:2020-08-17 06:36:03 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat)
ssdeep 24576:BAOcZeJqyD384W9xhjNHroy0Gxg539FQZMaBQiRtZ:bzDIhjNMYxw96ZMARH
Threatray 889 similar samples on MalwareBazaar
TLSH 8F151202B6D2C4B2E4721D324A2AAB256D3C7D304F34DA6EF7D0096DEA751D06625FB3
Reporter abuse_ch
Tags:exe RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: sd.latticesystems.com
Sending IP: 96.44.130.88
From: POEA MANILA <info1@poea.gov.ph>
Subject: POEA Advisory NO. 62-2020 ON ACCREDITATION OF AGENCIES
Attachment: DELISTED MANNING AGENCIES.PDF.LZH (contains "DELISTED MANNING AGENCIES.PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/46695/
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

SecuriteInfo.com.Gen.Variant.Johnnie.221809.751.14920.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Creating a file
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
Sending a UDP request
Creating a file in the %temp% directory
Adding an access-denied ACE
DNS request
Creating a file in the %AppData% subdirectories
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Setting a global event handler for the keyboard
Sending a TCP request to an infection source
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/432645
Signature
Allocates memory in foreign processes
Detected Remcos RAT
Drops PE files with a suspicious file extension
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Uses an obfuscated file name to hide its real file extension (double extension)
Writes to foreign memory regions
Yara detected AntiVM autoit script
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 268628 Sample: DELISTED MANNING AGENCIES.PDF.exe Startdate: 17/08/2020 Architecture: WINDOWS Score: 100 65 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->65 67 Detected Remcos RAT 2->67 69 Yara detected AntiVM autoit script 2->69 71 5 other signatures 2->71 14 efmtxu.pif 1 2->14         started        16 DELISTED MANNING AGENCIES.PDF.exe 63 2->16         started        19 efmtxu.pif 2->19         started        process3 file4 21 wscript.exe 14->21         started        59 C:\99168878\efmtxu.pif, PE32 16->59 dropped 23 efmtxu.pif 4 4 16->23         started        process5 signatures6 26 efmtxu.pif 21->26         started        79 Machine Learning detection for dropped file 23->79 28 wscript.exe 1 23->28         started        process7 process8 30 wscript.exe 26->30         started        32 efmtxu.pif 2 28->32         started        file9 35 efmtxu.pif 30->35         started        61 C:\Users\user\AppData\Local\...\RegSvcs.exe, PE32 32->61 dropped 37 wscript.exe 1 32->37         started        process10 process11 39 wscript.exe 35->39         started        41 efmtxu.pif 1 37->41         started        dnsIp12 44 efmtxu.pif 39->44         started        63 192.168.2.1 unknown unknown 41->63 46 wscript.exe 41->46         started        process13 process14 48 wscript.exe 44->48         started        50 efmtxu.pif 46->50         started        process15 52 efmtxu.pif 48->52         started        55 wscript.exe 50->55         started        signatures16 73 Writes to foreign memory regions 52->73 75 Allocates memory in foreign processes 52->75 77 Injects a PE file into a foreign processes 52->77 57 efmtxu.pif 55->57         started        process17
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/6d833bd671f179c8dfdf89aac0bc77cd7bb49f82a98cbf5d8122a9d47fa98e9f/
Threat name:
Win32.Trojan.Tiggre
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 02:19:05 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nwbtxvtr6f44rx67rgvmbpdxzv53jh4cvggl6xmbeku5i75jr2pq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
10189128ff7ff4ae10111c65ca809615595304636a0d0e451ee34bf23ee900a2
RemcosRAT
1678611ad4996f718c0a8998ce194dfe117bf47529c4ccad51a6816ecf4f1bb4
RemcosRAT
1acf4f64dbce46e70553494cf02959634528477066cc736e3f49df3bb6253923
RemcosRAT
1ca9978db84d8cad7f6a8f838e106799352c386cfa3aee2bbefa195e7fabe166
RemcosRAT
28d1ce2d141fcfc52b6b8a81f5424920ba2818a14e8ac201446697ff977082de
RemcosRAT
3a61804bb8302d42eb46c25a884cf50e7e6e383a9a48bfbfb1cfbe78ed2ed389
RemcosRAT
4d13350ebf3d38475a0a4a8c223fe6c06e00af3585eb499f60e29639b3944d3f
RemcosRAT
9d1f32d9806bafd63451a59e1768502f31cf9dc746c9e92f62b978c1ed259497
RemcosRAT
b14306aa1789a4d6b9bfa4f8c9392033ef0fc70e584addad632135f7f832dec1
RemcosRAT
fba31181ed1957e81c452fa1e860414d3a2bd2da470074a32f196f873a37d9ad
RemcosRAT
+ 879 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
rat family:remcos persistence keylogger trojan stealer spyware family:nanocore
Link:
https://tria.ge/reports/200817-sj47xsxzaj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
NanoCore
Remcos
Malware Config
C2 Extraction:
alhabib4rec.freeddns.org:2404
alhabib4rec.ddns.net:2404
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6d833bd671f179c8dfdf89aac0bc77cd7bb49f82a98cbf5d8122a9d47fa98e9f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_RemcosRAT
Create hunting rule
Author:abuse.ch
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

39e25c5641e733c260e3d691d0baefe2

RemcosRAT

Executable exe 6d833bd671f179c8dfdf89aac0bc77cd7bb49f82a98cbf5d8122a9d47fa98e9f

(this sample)

  
Dropped by
MD5 39e25c5641e733c260e3d691d0baefe2
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/46695/

Comments