MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8df9bddf123ffa3fa0f312d56bedde096310a02676e2b023530d8cd6856caa37. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8df9bddf123ffa3fa0f312d56bedde096310a02676e2b023530d8cd6856caa37
SHA3-384 hash: e5759c634fc1701faacbea3c4086711fb251afb34ae1acd4749ad99dbbb6745ea07c0e4bdbda41ecee8baa4b6cd3b4f9
SHA1 hash: 3558cc4e1f8a7e1fa66c5b87d6d9c13a84c3ea05
MD5 hash: dbdb5a6b2853b3040043312f422fd3cb
humanhash: zebra-sierra-west-kentucky
File name:agent2.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:126'976 bytes
First seen:2020-05-09 12:44:34 UTC
Last seen:2020-05-09 14:46:00 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 5f0c90c109d16124e83cb7a25caef54f (28 x RemcosRAT, 1 x FormBook, 1 x NetWire)
ssdeep 3072:mlh1qaSs6IF9OK4b80S2Van4Va1cpcQjed5OzqhUWa:Ch1qn3IF9Obbj/a1cpcQjeHOzqhUW
Threatray 776 similar samples on MalwareBazaar
TLSH D6C3F867F20B80A3D863027156507B72EEBCBC321A5D5157E7E8D8811DF588E9026AFF
Reporter James_inthe_box
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Rescoms-6598304-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Rescoms
Create hunting rule
Status:
Malicious
First seen:
2020-05-09 08:46:33 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
29 of 31 (93.55%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rx433xysh75d7ihtclkwx3o6bfrrbibgo3rlai2tbwgnnblmvi3q._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
11a7d2f2722df45e01851eb75765dbcb21f70ea9c8f89f58b9e8ccacda92cc83
RemcosRAT
1d8df098798099b8106386eb335e7f793d9ce4c14c863105aa2f260cea331c44
RemcosRAT
3a90457357756473cd15940468d7af9b7862d683c3c29fa0f01e69720023bdd1
RemcosRAT
49c1e306362700be6143f3dc9592a72ca5d9dc3d7237d9f8e4f14b5c14ea2155
RemcosRAT
83413a3a3f07ee931dbfecaefed51d0b01d2b13b85920bdd485f0b2ce41acba5
RemcosRAT
a899d2b8f1cf3d0a97107dcfecafb3239cade9e8aad01fe007f3b0d8762b8b7a
RemcosRAT
c409017de52a4a6ad3a0cd3ab97ad17f9be172136155bf548bef49d7777cec1a
RemcosRAT
db28682ec511e61fa9a6425d0c7a908a99cf19b3f08c81b0e61bec26e24a15d6
RemcosRAT
e3b9a35e9155fd3c927956f03d54da02f28cc27437537d67ba302ddb4a40e57b
RemcosRAT
e9f204296b816ecf645ea8401bd531f3880634c81fb37224f39d9af058e2c08f
RemcosRAT
+ 766 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos persistence rat
Link:
https://tria.ge/reports/201109-4sj4ys67zx/
Behaviour
Suspicious use of WriteProcessMemory
Modifies registry class
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Remcos
Malware Config
C2 Extraction:
freenigga.ddns.net:7082
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_RemcosRAT
Create hunting rule
Author:abuse.ch
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
  
URLhaus
https://urlhaus.abuse.ch/url/360415/

Comments