MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8247baad6838676fb803763c3995eb735d8535045c344349fb8cf90e9e22534d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8247baad6838676fb803763c3995eb735d8535045c344349fb8cf90e9e22534d
SHA3-384 hash: fb7f85afc6079298c9d4c36265ed7c78271cc27c46ef6f8c3ad1d3818fe45f7b59ea146a3d21b2a833b04172898cc3e5
SHA1 hash: 39aaf16116a74524bfe9327ae2047a3be58390eb
MD5 hash: a09d8f7878cd06109cd03e76e8983e32
humanhash: mike-sierra-minnesota-carpet
File name:571CM-08 BAG FILTER FOR BF03_04 CEMENT MILL DIA 160 X LENGHT 6000mm-Model.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:114'688 bytes
First seen:2020-05-11 17:29:24 UTC
Last seen:2020-05-11 19:04:34 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 6b7d47199fae2399f9ee150e2ba3f668 (1 x RemcosRAT)
ssdeep 1536:/fTn2g/x9kP+lR8s+PjViM56Jm0FijxOMr2rS78xSBAgljPOwcAdvXoMlEH57poM:zX/esABiNmwbMm
Threatray 1'387 similar samples on MalwareBazaar
TLSH 21B3E71461D0E11AEAFA8DF1579673C9D2EEAC3E7401760727D1330ED73A881AA9137B
Reporter abuse_ch
Tags:exe nVpn RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: qproxy4-pub.mail.unifiedlayer.com
Sending IP: 66.147.248.250
From: JAVARIA ZAFAR ~ INTERSCAN <javaria@interscan.com>
Reply-To: JAVARIA ZAFAR ~ INTERSCAN <noraimiomar.petronas@gmail.com>
Subject: INTERSCAN REF# E- 378/19-20 FILTER BAGS FILTRAS FILTRE
Attachment: 571CM-08 BAG FILTER FOR BF03_04 CEMENT MILL DIA 160 X LENGHT 6000mm-Model.r00 (contains "571CM-08 BAG FILTER FOR BF03_04 CEMENT MILL DIA 160 X LENGHT 6000mm-Model.exe")

RemcosRAT C2:
185.140.53.37:1900

Hosted on nVpn:

% Information related to '185.140.53.0 - 185.140.53.255'

% Abuse contact for '185.140.53.0 - 185.140.53.255' is 'abuse@FOS-VPN.org'

inetnum: 185.140.53.0 - 185.140.53.255
netname: Freedom_Of_Speech_VPN
remarks: Before you contact us, please read:
remarks: 185.140.53.0/24 belongs to a NON-LOGGING VPN service.
remarks: We don't log any user activities.
remarks: We believe that the right to informational self-determination and the
remarks: right to privacy are essential to all citizens of all countries.
remarks: We don't host anything else on our servers than VPN software and our
remarks: customers can open a fixed number of Ports.
remarks: Like Public WiFi or Tor Exit Node Operators we cannot be held responsible
remarks: for the actions of our customers, because we simply can't (and to be
remarks: honest: don't want) to control them.
country: EU
org: ORG-SL751-RIPE
admin-c: SL12644-RIPE
tech-c: SL12644-RIPE
status: ASSIGNED PA
mnt-by: FOS-VPN-MNT
created: 2016-10-17T23:24:00Z
last-modified: 2020-04-06T18:59:49Z
source: RIPE


Intelligence

File Origin
# of uploads :
2
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Fareit-FTAA09D8F7878CD.20284.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 17:35:44 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qjd3vllihbtw7oadoy6dtfplonoyknielq2egsp3rt4q5hrckngq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
guloader
Create hunting rule
Similar samples:
01dc41b35298ebb01d00083efa17adad8e1c7c4ab40f77f6d943f7031359ccb6
RemcosRAT
4ea3eef0add7aca2f63815588a3a3131c876a50e189e6764f991e15bfc5167fd
RemcosRAT
54091d6f7893b5a42baebba2ea94def14f9181a46544633116be5f1772811236
RemcosRAT
6a8c926b0abdd80065d08a14964e2666778730abc1e1c8bc2e570519758bea22
RemcosRAT
7371e1b74410000cb35049d74ba9f63da63cabfc28f9aae86769136d7e435ad7
RemcosRAT
804dcb4fefd588584f1e6dab425f4167aba62ca60e2d3989ff673c92a3ffb8b1
RemcosRAT
b4f2ec035ed04a9dc31102c9ecfa331fec9e3c611aa8ac70b9c07e5574d47df1
RemcosRAT
ce53e7d6bf4497672eb6798ad63488ae41f3943601b76d390761006b56f3befe
RemcosRAT
e0832a1f553c7fb2766cd743aefc05bbff71cd5a0c6737d9e65d784d7c8ac2de
RemcosRAT
fdd40bcfba668b785d404214fd35db117b186e21944b24f16540cce86f7bec78
RemcosRAT
+ 1'377 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-ctgh57dxh2/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Legitimate hosting services abused for malware hosting/C2
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

29055ca60fa502ee103a8e77b4188a45

RemcosRAT

Executable exe 8247baad6838676fb803763c3995eb735d8535045c344349fb8cf90e9e22534d

(this sample)

  
Dropped by
MD5 29055ca60fa502ee103a8e77b4188a45
  
Delivery method
Distributed via e-mail attachment

Comments