MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7aef6a3d7f631fc8fb00123ec3842c3d4e4e6c1c6d81a7a9559832f79cc14c9b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 10

Intelligence 10 IOCs YARA 9 File information Comments

SHA256 hash:	7aef6a3d7f631fc8fb00123ec3842c3d4e4e6c1c6d81a7a9559832f79cc14c9b
SHA3-384 hash:	ff9bfe87f54f499be8dbac30bbf0cec2684855f4d06d6615ea4d652826bba2b954a30ba5d1edd3c61b2818f557e7d4ee
SHA1 hash:	d807fa0c206763075d2aae75393d138088e906de
MD5 hash:	cd2cd9f833fac58c909e25cfe6ca277e
humanhash:	arkansas-maine-montana-mango
File name:	Giá FOB tính bằng USD..KQ13jvZ9uFZOE8U.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	721'920 bytes
First seen:	2021-01-31 07:45:29 UTC
Last seen:	2021-01-31 09:59:20 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'662 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	12288:6BeBkAF+bikAttwYNvUTLuBftKnonAinULc/595xGvOn9OFc9fSDK5pi8XYs64tA:6BeBkAeikAPVNvUT6Bftj7ULcB/xG29e
Threatray	3 similar samples on MalwareBazaar
TLSH	8DE402303298FB71D67FB7781570460013F0E50AD723EB6DBF9820DA6A52F8587A6752
Reporter	abuse_ch
Tags:	exe geo RAT RemcosRAT VNM

abuse_ch

Malspam distributing RemcosRAT:

HELO: vps.asswart.com
Sending IP: 45.85.90.28
From: procurement <office@briglum.com>
Subject: Giá FOB tính bằng USD.
Attachment: Giá FOB tính bằng USD..KQ13jvZ9uFZOE8U.iso (contains "Giá FOB tính bằng USD..KQ13jvZ9uFZOE8U.exe")

RemcosRAT C2:
nwajesu2021.ddns.net

Intelligence

File Origin

# of uploads :

# of downloads :

173

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Giá FOB tính bằng USD..KQ13jvZ9uFZOE8U.exe

Verdict:

Malicious activity

Analysis date:

2021-01-31 07:50:30 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/42035042-5215-4f68-a7c7-5fc941c9f14d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Remcos

Link:

https://www.capesandbox.com/analysis/114920/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Launching a process

Creating a process with a hidden window

Launching the default Windows debugger (dwwin.exe)

Creating a process from a recently created file

Result

Threat name:

Remcos

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/594746

Signature

Detected Remcos RAT

Injects a PE file into a foreign processes

Multi AV Scanner detection for dropped file

Sigma detected: Remcos

Sigma detected: Scheduled temp file as task from temp location

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses dynamic DNS services

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected AntiVM_3

Yara detected Remcos RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

remcos

Link:

https://mwdb.cert.pl/sample/7aef6a3d7f631fc8fb00123ec3842c3d4e4e6c1c6d81a7a9559832f79cc14c9b/

Threat name:

ByteCode-MSIL.Trojan.Wacatac

Status:

Malicious

First seen:

2021-01-31 07:46:11 UTC

AV detection:

18 of 46 (39.13%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=plxwupl7mmp4r6yaci7mhbbmhvhe43a4nwa2pkkvtazpphgbjsnq._file

Verdict:

unknown

RemcosRAT

60a77ee5b32933d4ecd4c6302f62d1ff9ae732b24350c67ac0b6b84f253a867c

RemcosRAT

9b673be5e2878f552738a2fa3c4a776c762e8686a5156be1feeb7b4e947fea2c

RemcosRAT

Result

Malware family:

n/a

Score:

5/10

Tags:

ransomware

Link:

https://tria.ge/reports/210131-jy52tkzpwn/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Program crash

Enumerates physical storage devices

Unpacked files

SH256 hash:

7aef6a3d7f631fc8fb00123ec3842c3d4e4e6c1c6d81a7a9559832f79cc14c9b

MD5 hash:

cd2cd9f833fac58c909e25cfe6ca277e

SHA1 hash:

d807fa0c206763075d2aae75393d138088e906de

Link:

https://www.unpac.me/results/b0d2c8ad-5d82-419b-a554-08352d6dabc3/

SH256 hash:

ef8424b924d357536efc37f6ba3ed11e9db781dd4fdd418251af8164a345436f

MD5 hash:

b7395a6404a230051855ca1880898a95

SHA1 hash:

49c576525cf29dcdcc45fc40678b1c5e96a7d34d

Link:

https://www.unpac.me/results/b0d2c8ad-5d82-419b-a554-08352d6dabc3/

SH256 hash:

4c83960a484b9b1ff96c346f04e09ea22097c2a78a50aeea2d04d56e59af7049

MD5 hash:

6317ff66d98c6fa51a605e753bed2fd3

SHA1 hash:

949f26421822d30e45de11ee44d24ea70ad90a44

Link:

https://www.unpac.me/results/b0d2c8ad-5d82-419b-a554-08352d6dabc3/

SH256 hash:

c1023d0ffd7e6faaf0629ef70deb6927867bc6393c9ff403bce0ea1c42d267ab

MD5 hash:

47065b7823107508e591519560ced2aa

SHA1 hash:

76feea6ef5d96231a2cdb927f6488de6720562dd

Detections:

win_remcos_g0

win_remcos_auto

Link:

https://www.unpac.me/results/b0d2c8ad-5d82-419b-a554-08352d6dabc3/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7aef6a3d7f631fc8fb00123ec3842c3d4e4e6c1c6d81a7a9559832f79cc14c9b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_RemcosRAT Create hunting rule
Author:	abuse.ch

Rule name:	Chrome_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Chrome in files like avemaria

Rule name:	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer Create hunting rule
Author:	ditekSHen
Description:	detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Rule name:	Keylog_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Contains Keylog

Rule name:	Parallax Create hunting rule
Author:	@bartblaze
Description:	Identifies Parallax RAT.

Rule name:	Remcos Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Remcos in memory

Rule name:	remcos_rat Create hunting rule
Author:	jeFF0Falltrades

Rule name:	REMCOS_RAT_variants Create hunting rule

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator