MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 81783c63ad44bdb77b3db79ec3cafb33222395e89d765c4ffbab36ea6b9c96eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 81783c63ad44bdb77b3db79ec3cafb33222395e89d765c4ffbab36ea6b9c96eb
SHA3-384 hash: 8ee002ac192482fc7ad09c48a00f181498bf900edd855e71b0bb5dad4cc14e0b777c97acce1e826c9b29979ee280b5ae
SHA1 hash: cc87dd42d50ae5413421c6c88bdb890c67408052
MD5 hash: 9023771d44417c6b8409d4e238804b6c
humanhash: finch-pennsylvania-mars-apart
File name:81783c63ad44bdb77b3db79ec3cafb33222395e89d765c4ffbab36ea6b9c96eb
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:342'016 bytes
First seen:2020-06-17 09:21:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 3072:CzQgBOSOm06uNDTnFIcqvPwl+n0lLPjpymmQfRZ8XVMHluaqLIQHRhxsllD7g5Z3:ChduBTnFoYl+0ZPjpyb+Ya3gm9x
Threatray 818 similar samples on MalwareBazaar
TLSH 0E743810E9E9C41AED794A77E980F1F19735AEE3F10E9B1B55C13E063A72B02C97074A
Reporter JAMESWT_WT
Tags:RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/19337/
Detection(s):
Win.Trojan.Vendetta-8019875-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 16:22:18 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
27 of 30 (90.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qf4dyy5nis63o6z5w6pmhsx3gmrchfpitv3fyt73vm3ou244s3vq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
147e92a20eaa350aef112cd3110af132aa9667af4e8eb90d345d4b7da8cea95c
RemcosRAT
286add28a79440668077a7d762ee81ee169f1c08daa27bc680dbf8c8832d2785
RemcosRAT
4c886afcf091e440b12ade502e4b8dcd2e9995cb2c10d7c0f8fd16e736d6fca6
RemcosRAT
713c780c42db40b3456b797e578c889f19a915441a428277aaa8235dfecd0142
RemcosRAT
92632fa88b730e2593837c7d51884384dcf8c887fd4b8d3cc6741d12ae9cd347
RemcosRAT
b26960e8083466e40ebbfcc6dfe93c4080a516d6260e1a2900ce7649fc44442e
RemcosRAT
b2bccd13743ac9153a8b731af82d6b19fa7395dd16596a3b5f783f1092419c3a
RemcosRAT
bcaf5698e3d5291c284e0ea40deec27e69c4942049f1c90a4e334e066485dfa9
RemcosRAT
c068b1a7379f95ee883cd4ed9639bb2b28c380934f3bc0e0c7be97ad808c7b8a
RemcosRAT
c315112980543e9046f7b3167586d3a5ba25734aac85679542adaca7867f3ef7
RemcosRAT
+ 808 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
rat family:remcos
Link:
https://tria.ge/reports/200624-9sjd14zk4x/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Creates scheduled task(s)
Suspicious use of SetThreadContext
Remcos
Malware Config
C2 Extraction:
212.83.46.23:3110
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Remcos
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Remcos in memory
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/19337/

Comments