MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 958139fdff65190d5ec118b4ac6ceec3a2d4b69932e72edb4ce6ae308ba13f47. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 10

Intelligence 10 IOCs YARA 6 File information Comments

SHA256 hash:	958139fdff65190d5ec118b4ac6ceec3a2d4b69932e72edb4ce6ae308ba13f47
SHA3-384 hash:	8abb96362e1a06ae8131b77d3f44afb63a2e1bf30a2b51d23ad37c769a9bfadbf42ccec0d984513b9de71fe1d8278d92
SHA1 hash:	d2cac73edc6c75a4eb9aa285de3376a958d6edd5
MD5 hash:	6dbd64b3144690b6dc393710c70f3636
humanhash:	hot-thirteen-lima-iowa
File name:	6dbd64b3144690b6dc393710c70f3636.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	408'576 bytes
First seen:	2020-10-30 15:16:59 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:fOjdT8nNnpgeXBvpDR+MuT4vnSjq+i8o7:gdWnn1p1/Kq+2
Threatray	1'000 similar samples on MalwareBazaar
TLSH	9F94026962A4C30DDEBD167EF42012380375BD92A281FFBA4B04FACE1B6B75595081F7
Reporter	abuse_ch
Tags:	exe RAT RemcosRAT

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Remcos

Link:

https://www.capesandbox.com/analysis/81301/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file

Launching a process

DNS request

Sending a UDP request

Connection attempt to an infection source

Unauthorized injection to a system process

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Remcos

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/517116

Signature

Contains functionality to capture and log keystrokes

Contains functionality to inject code into remote processes

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Detected Remcos RAT

Drops PE files to the user root directory

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Remcos

Writes to foreign memory regions

Yara detected Remcos RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/958139fdff65190d5ec118b4ac6ceec3a2d4b69932e72edb4ce6ae308ba13f47/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-10-30 12:27:36 UTC

AV detection:

16 of 29 (55.17%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=swatt7p7mumq2xwbdc2ky3hoyornjnuzglts5w2m42xdbc5bh5dq._file

Verdict:

malicious

Label(s):

remcos

RemcosRAT

257b2b1a5694438c684e9d4fd44141fc3f09a18d15ebef5e46aad1603afa0b0c

RemcosRAT

2aca994114835d2663353454df341285535994068284d9cbbb03e2e87f388b80

RemcosRAT

3270cfe3f15d8303d43e64e082d89eabb0737af61637393ed6d4922c3cba3909

RemcosRAT

4a024542511c7d0a40e8317486b7177eaf71ee355f1731f17bc632731ea814b0

RemcosRAT

5a418e084b49b740a94d307baf45d67ac25db462fdeb80065fb60ffeb197273f

RemcosRAT

6637c089017af9c448d8235e20db32603d8547f0611187341cf184dc66c170b4

RemcosRAT

95167e64d46e5f0e9821b379aa7e412f57d14fe11e613bdcab38cb47dc217bbc

RemcosRAT

b4b5110b2babce8946d262e6f75215f1c7a6f036eeb3eda5223b9430d5235d46

RemcosRAT

e037b5ebac7b3ac81b3e268268dbd072784c73f178662e4a66e5e57d7e8a67c3

RemcosRAT

+ 990 additional samples on MalwareBazaar

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos rat

Link:

https://tria.ge/reports/201030-1sl3m3x1s6/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Remcos

Malware Config

C2 Extraction:

ndma.chickenkiller.com:24311

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Backdoor

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/958139fdff65190d5ec118b4ac6ceec3a2d4b69932e72edb4ce6ae308ba13f47

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_RemcosRAT Create hunting rule
Author:	abuse.ch

Rule name:	Chrome_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Chrome in files like avemaria

Rule name:	Keylog_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Contains Keylog

Rule name:	Parallax Create hunting rule
Author:	@bartblaze
Description:	Identifies Parallax RAT.

Rule name:	Remcos Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Remcos in memory

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator