MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8c59bc29addb6c7cd78946b0f449b39ba663b0311d80c1a55b54742e7facb8af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	8c59bc29addb6c7cd78946b0f449b39ba663b0311d80c1a55b54742e7facb8af
SHA3-384 hash:	c8acb1199853e28529b98b9fd55a31357807070fba41789f255b752f9b146a3cfe86ab073a9764b98d2b0af0e84e3e51
SHA1 hash:	7cdeca35860f00b86682fa5f3ce069161e751e4f
MD5 hash:	5057d94ffda400296dd29e5b0d89b5b5
humanhash:	chicken-eleven-rugby-monkey
File name:	ORDERS.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	259'584 bytes
First seen:	2020-07-15 09:55:08 UTC
Last seen:	2020-07-15 11:41:35 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	6144:+IseNVhCd8lkMGkDQutWlboCvoHwh8AsXqw2ats:VVYWS6J0lbo72aq
Threatray	876 similar samples on MalwareBazaar
TLSH	CD44D011B7BD5B16F5BD8BF5163584880BF6765A7565E70C0CC2B0DA10BBB088BA1F23
Reporter	JAMESWT_WT
Tags:	RemcosRAT

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Remcos

Link:

https://www.capesandbox.com/analysis/25962/

Detection(s):

SecuriteInfo.com.Trojan.DownLoader33.59431.24772.3195.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

DNS request

Creating a file in the %AppData% subdirectories

Setting a global event handler for the keyboard

Sending a TCP request to an infection source

Detection:

remcos

Link:

https://mwdb.cert.pl/sample/8c59bc29addb6c7cd78946b0f449b39ba663b0311d80c1a55b54742e7facb8af/

Threat name:

ByteCode-MSIL.Trojan.Dapato

Status:

Malicious

First seen:

2020-07-15 09:55:30 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

23 of 29 (79.31%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=rrm3yknn3nwhzv4ji2ypisnttotghmbrdwamdjk3kr2c475mxcxq._file

Verdict:

malicious

Label(s):

remcos

RemcosRAT

13eaaf168207a5014c105532b6a23805fc6db28f73908914a4583979173cc254

RemcosRAT

1d510653c1ea9f9a519c53d92067ab27ee434f8e5c34b980f6a236f4e02dba22

RemcosRAT

356c197426a3bdabccf7b10ece0a425571b55bbeb7e09e3121b6ff6b7c2e253a

RemcosRAT

397545efcbf53bebabdb003bbe9f8b619b7ffdd5383c21ecd9e99c6de3e3cd83

RemcosRAT

5106eff2035cae4bc844f175750857ecffe095b70f7872ddd212bedce7776e80

RemcosRAT

611a1ab90193672c4b95cb934a617b98314df0a24406342a0f1fedb08efd1997

RemcosRAT

b101b46c4af2b0bf121699278385567d8acf726dc94d85d304d86f48312065d2

RemcosRAT

c8c1e04edd5c422d065e27a3a73931d373de200419cd9ba649fdfadee686e5f2

RemcosRAT

d69aa1932b2e702e5065ee19da9fc9cf2b05e7dbaa617141b14eaa501a14955e

RemcosRAT

+ 866 additional samples on MalwareBazaar

Result

Malware family:

remcos

Score:

10/10

Tags:

rat family:remcos

Link:

https://tria.ge/reports/200715-eanwwys256/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of SetThreadContext

Remcos

Malware Config

C2 Extraction:

muchogroup.ddns.net:5050

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_RemcosRAT Create hunting rule
Author:	abuse.ch

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator