MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e10d24d51ab300669a5980acfbb9589f16246ee81c6aab569fde0725390e1e1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 3

Intelligence 3 IOCs YARA 2 File information Comments

SHA256 hash:	6e10d24d51ab300669a5980acfbb9589f16246ee81c6aab569fde0725390e1e1
SHA3-384 hash:	fffe8b0d88e301f353589f4c11e6aae1bf0b313e288466f94254039b1f7ea8fa2f54a93a320bc924b38a7b8ec13b65a9
SHA1 hash:	5e3d6faa54ca6470ef5d191f567c2965ad25f3f2
MD5 hash:	4c8aa17db8e8e025c3668d46a877dedf
humanhash:	crazy-early-india-sierra
File name:	details.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	1'054'722 bytes
First seen:	2020-05-04 22:40:46 UTC
Last seen:	2020-05-05 08:41:58 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	e453637f2317c3675b7b06b57403e87a (2 x RemcosRAT, 1 x GuLoader)
ssdeep	24576:cgTfvH5kDYtfLWyfhcEwyzdtmIk5ZtOs4:cgTffS1sOctmIj
Threatray	55 similar samples on MalwareBazaar
TLSH	5C257D22A253DA37C123553C9D7B56B8E836BE136F6858472AF52C3C1EF93413837296
Reporter	abuse_ch
Tags:	exe nVpn RAT RemcosRAT UPS

abuse_ch

Malspam distributing RemcosRAT:

HELO: ours4.westcentralus.cloudapp.azure.com
Sending IP: 52.161.106.35
From: UPS Customer Service <customer@ups.com>
Subject: UPS - Pending delivery
Attachment: UPS_FILE.ISO (contains "details.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

101

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Variant.Zusy.302747.15832.15474.UNOFFICIAL

Gathering data

Threat name:

Win32.Trojan.Delf

Status:

Malicious

First seen:

2020-05-04 23:35:23 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

21 of 31 (67.74%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=nyinetkrvmyam2nftafm7o4vrhywerxoqhdkvnlj7xqheu4q4hqq._file

Verdict:

unknown

RemcosRAT

36e4352b2e4961e1ca1dd47baadf462af3e97fd0ebfb0c5694a5c6e22322c1c1

RemcosRAT

580cc9e785ffa316f63b39365e7f21a570404fd833046d09e5e132aadde7a4ba

RemcosRAT

58421a1f4ace3bf3d22cc6133e1eee78253cebf89262eebe0d14423c4552a2c7

RemcosRAT

5e81e0f0aa8ff34a845b62472a3d2a83fa43ee47819dbc841d8004b64ffd79fc

RemcosRAT

888750cee6858ec2c6131628caa562be26b1c65ecaeff4addcbf73a456c99517

RemcosRAT

951cf534559a88818ccf0aa18e0b771a9e8159f40ecba9c58ceb5ba720859af8

RemcosRAT

b0d9f78957650a0bc42b0bf646e3d158f713de64ee5e6ab395cf777e93a7a240

RemcosRAT

c69659689b7727a9478bc248fb3395fb487df4542f14503420b750fd64765e35

RemcosRAT

d98c29847ea4a1acbc30f95ede18759d9f2ed343dd99d85a542efdf23fd497e5

RemcosRAT

+ 45 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

6/10

Tags:

n/a

Link:

https://tria.ge/reports/201109-d5fcekk3js/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Legitimate hosting services abused for malware hosting/C2

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_RemcosRAT Create hunting rule
Author:	abuse.ch

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator