MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8103aa73cb97864c64e9ad480e48f26cc5bd20470b7642c73dd73a3a2dc77008. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8103aa73cb97864c64e9ad480e48f26cc5bd20470b7642c73dd73a3a2dc77008
SHA3-384 hash: 636ce216a0bcff05fdef6a0382f3baf39175eebb3fd6303996302bfa8a686e3bf8e0b1fe02c13214477637680ed4dad6
SHA1 hash: cfdc430d64f11f3c49d70fbc47da8d2d36ae0f07
MD5 hash: 5b39499a530caa5b1cc411c8f497e993
humanhash: sodium-pizza-uniform-leopard
File name:5b39499a530caa5b1cc411c8f497e993.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:696'832 bytes
First seen:2021-05-20 14:14:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:nAvEenFpqkKzAkkkkkkkkvkkkkkkkkb02rhoIFib7KggJ04leiDSV0Wm6bAWz6KC:nAvBnqdzZuhoIFibNg1eiDSV/EWz6j
Threatray 119 similar samples on MalwareBazaar
TLSH 2CE4F13262498FA5E07B4BB9546070446BF0E606F761E31C7E6420ED3D92F56ABA1F83
Reporter abuse_ch
Tags:exe RAT RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
115
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/159693/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.747-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8103aa73cb97864c64e9ad480e48f26cc5bd20470b7642c73dd73a3a2dc77008/
Threat name:
ByteCode-MSIL.Trojan.Injuke
Create hunting rule
Status:
Malicious
First seen:
2021-05-20 01:24:00 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qeb2u46ls6deyzhjvvea4shsntc32ichbn3efrz5245dulohoaea._file
Verdict:
unknown
Similar samples:
05086999ecc84bd9719e6acb4f579d42f8f41e1f9c6bfa2c0fb33a68640ec23a
RemcosRAT
2438fa1a881abb8baa3b9025ab3bb0f670cf3b3e133e5ac4f26fea8e6f381197
RemcosRAT
31000275499b6bf142cdb597bb10762150e0987982a292d7b55b16a8c55078a3
RemcosRAT
410767dbae4a96be20f3776b69d9e894ff1ef1d44373fde0d5ef6db9f297639d
RemcosRAT
4517b5b27d09b03d48a937543a32e122c09fa3b66f2546c67cf25117a041115a
RemcosRAT
6d2229b8b51edbe8b0530281f83a3054e79aaaba762dbb046b4e2853fac2dbde
RemcosRAT
724e061a8e3a64c9e27683b3a43042bc04224609dc949ec0e39f5049667b7999
RemcosRAT
900c89761ea2df2b44a4c9ddd45e6fb8f02ec0cad9f9c50393378f6228ec9899
RemcosRAT
ad48ab335ebd805d1b7cc14e085454228922b464f051029f82f3d9eb3c78b199
RemcosRAT
e83aecbd4da2636ae20a53d56a240e15374e5482799ca08e7d1ba9bad55d7535
RemcosRAT
+ 109 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/210520-erbzd18vmj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8103aa73cb97864c64e9ad480e48f26cc5bd20470b7642c73dd73a3a2dc77008

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

Executable exe 8103aa73cb97864c64e9ad480e48f26cc5bd20470b7642c73dd73a3a2dc77008

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/159693/
  
URLhaus
https://urlhaus.abuse.ch/url/1002465/
  
Delivery method
Distributed via web download

Comments