MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 753883fa972dda966abb3adad3cfc94f0a82ca128d1908df58bac3ba93e60bd3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 753883fa972dda966abb3adad3cfc94f0a82ca128d1908df58bac3ba93e60bd3
SHA3-384 hash: 067c1197a8eac5f0eec76d7341f35447afe597601d54c5d14c504d22fd1fe57d683300a8362ecc7da74a04494180829c
SHA1 hash: 60270925b7065f0aaa5b01f3b8b98b342565637b
MD5 hash: 7c83ed4894792f2f7655225c04424a47
humanhash: seven-papa-beer-early
File name:Q0ynQC2u.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:94'208 bytes
First seen:2020-03-22 15:56:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d3a62971944197f0701c7049a9c739d1 (60 x RemcosRAT)
ssdeep 1536:whhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP6jrj:WhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+k
Threatray 743 similar samples on MalwareBazaar
TLSH FB93C713FA4AD0B2E46591F146426F32CEBCBC3736492173D38FCA419D79892D416EAE
Reporter johannes
Tags:remcos RemcosRAT


Avatar
viql
remcos via https://pastebin.com/raw/Q0ynQC2u

Intelligence

File Origin
# of uploads :
1
# of downloads :
117
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Rescoms-6598304-0
Create hunting rule

Win.Malware.Zusy-6832224-0
Create hunting rule

Win.Malware.Azden-7587127-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Rescoms
Create hunting rule
Status:
Malicious
First seen:
2020-03-22 18:48:43 UTC
AV detection:
28 of 30 (93.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ou4ih6uxfxnjm2v3hlnnht6jj4fifsqsrumqrx2yxlb3ve7gbpjq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
047ab465004dfd698d0ef47967162e77e6c46b575832d60fab82b440ce8e44e7
RemcosRAT
62115059096fc430f5e8b4cfe6884444fbb2b0733760a7f4a9856791f1151ba9
RemcosRAT
89313534a5c4579b6a00425281ef0473246cfb2340653bd3cf41b584bfa40578
RemcosRAT
8f326df009924cd7bf93a0a9cb83f1ae42adec4e7afce32971da35a8d792a223
RemcosRAT
97008666a70fcc824511b881a3ac67640fe8c4aa79c21111e40f8d3a9ad54740
RemcosRAT
a40433c26e7cfe28975ff5b5334109e00b8e7ab9bdb8f39818b3d6eb01756978
RemcosRAT
abd4e6ee8152822c0545bd27a4f4c5114728873873e227044dfb48ecf1ecb37f
RemcosRAT
c851749fd6c9fa19293d8ee2c5b45b3dc8561115ddfe7166fbaefcb9b353b7c4
RemcosRAT
d06558cd5d7615d66ea2d806877d962994732909cf003eff4b95d62100840b70
RemcosRAT
d9498f5a8b798490a85fa6878b5c7ac624b75259390ff4504adb52a11b3ea258
RemcosRAT
+ 733 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://pastebin.com/raw/Q0ynQC2u

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
GDI_PLUS_APIInterfaces with Graphicsgdiplus.dll::GdiplusStartup
gdiplus.dll::GdipGetImageEncoders
gdiplus.dll::GdipGetImageEncodersSize
gdiplus.dll::GdipAlloc
MULTIMEDIA_APICan Play MultimediaWINMM.dll::waveInAddBuffer
WINMM.dll::waveInClose
WINMM.dll::waveInOpen
WINMM.dll::waveInPrepareHeader
WINMM.dll::waveInStart
WINMM.dll::waveInStop
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AdjustTokenPrivileges
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteA
SHELL32.dll::ShellExecuteExA
SHELL32.dll::ShellExecuteW
URL_MONIKERS_APICan Download & Execute componentsurlmon.dll::URLDownloadToFileA
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessA
KERNEL32.dll::OpenProcess
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::VirtualAllocEx
KERNEL32.dll::WriteProcessMemory
KERNEL32.dll::CloseHandle
WININET.dll::InternetCloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::GetDriveTypeA
KERNEL32.dll::GetStartupInfoA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WinExec
KERNEL32.dll::AllocConsole
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileA
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateDirectoryA
KERNEL32.dll::CreateFileMappingA
KERNEL32.dll::DeleteFileA
KERNEL32.dll::DeleteFileW
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::GetUserNameW
ADVAPI32.dll::LookupPrivilegeValueA
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExA
ADVAPI32.dll::RegCreateKeyA
ADVAPI32.dll::RegDeleteKeyA
ADVAPI32.dll::RegOpenKeyExA
ADVAPI32.dll::RegQueryInfoKeyA
ADVAPI32.dll::RegQueryValueExA
WIN_USER_APIPerforms GUI ActionsUSER32.dll::AppendMenuA
USER32.dll::EmptyClipboard
USER32.dll::FindWindowA
USER32.dll::OpenClipboard
USER32.dll::CreateWindowExA

Comments