MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7771d53b355211234d9971d3942d35f18db71505cc5b107453975a6f5882b548. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7771d53b355211234d9971d3942d35f18db71505cc5b107453975a6f5882b548
SHA3-384 hash: f250f573fb20fc8f6f7c63db1041d5765c64b06773f7e5bbe93e307fc42dada15b99d6628e13290f45d5d5f823ca9f53
SHA1 hash: 86339259c4103d9ca1e90fffc725725b37284951
MD5 hash: 3699d146aa31e7332f40ec84d950fa6c
humanhash: rugby-asparagus-tango-summer
File name:DHL_Details.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:347'136 bytes
First seen:2020-03-20 12:22:14 UTC
Last seen:2020-03-20 13:34:59 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 6144:/mb2KA4laEBkkLMSnbV48CdQcZhG8NwKjZDE4JTWyMkbJ/S:kRA4AEBkkvVadQcRNwaA+WFkbJ
Threatray 11 similar samples on MalwareBazaar
TLSH F274BF4B52D4ABC6C9AE5AF8E0227502C338F0367553B71B56ECD1F02497B635CA26F8
Reporter jarumlus
Tags:RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.42866232.30649.8065.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-03-20 01:52:05 UTC
AV detection:
24 of 31 (77.42%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=o5y5kozvkiisgtmzohjziljv6gg3ofifzrnra5cts5ng6wecwvea._file
Verdict:
suspicious
Similar samples:
03a424fc93d692901bc1ca02b532934101c5448d093c9b0d74fa927f14304bd3
RemcosRAT
0436004314fee6516b09d6abb84e8402f237027025c4b22a2a9b327f636da647
RemcosRAT
3e30d9e15ee915170a4823f8a603376b1c77de63199c635bceaa086072358a8f
RemcosRAT
5e627b14e776856c2904f622b43da929fbc41c1d0b753cd0f98913d8eeaf3544
RemcosRAT
5ec2a270a9b0e335fb6ecf9d313e02771acad023d7a1a6168a15297d1f80312d
RemcosRAT
751dffc7391890afbcb40a55e29bd319d8b4a9e2e0438c5f5939ac09ab6ae297
RemcosRAT
92f6d1e82205b64904076dbcb9909bc3ff06cd4c58c87518470eefdd8b4df084
RemcosRAT
9edea7d68a48e54ec499302700e64a41a2cb38dab5d5d51c30c1ff2e40c393cf
RemcosRAT
c5886cce4cccd324633b1f7d2d7a007a238550d8174cbed7703aa9088db51ab3
RemcosRAT
ffd9c77f05ea4afd0d2e5a462cd632b0d472f94997915c2123e7de652d86f3a2
RemcosRAT
+ 1 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7771d53b355211234d9971d3942d35f18db71505cc5b107453975a6f5882b548

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_RemcosRAT
Create hunting rule
Author:abuse.ch
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_remcos_g0
Create hunting rule
Author:Daniel Plohmann <daniel.plohmann<at>fkie.fraunhofer.de>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments