MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a351faaa23105c8fde3cada56019c460dd7bc8579e027dfb56ef630e0b8649c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 10

Intelligence 10 IOCs YARA 6 File information Comments

SHA256 hash:	a351faaa23105c8fde3cada56019c460dd7bc8579e027dfb56ef630e0b8649c5
SHA3-384 hash:	5f9308caa01a3a94133bd938116c84cf3bc39cc1235ca97ac2d5fe044a5ef357ceebbf47753aa0c60f6ca8ea07d7a0c2
SHA1 hash:	08ccfbbdf86315bcd0161270a4f35d62dd5329e2
MD5 hash:	11b176535fb838b27d5b780bfb0cfcb6
humanhash:	fanta-earth-cat-stream
File name:	11b176535fb838b27d5b780bfb0cfcb6.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	738'304 bytes
First seen:	2020-10-31 06:49:25 UTC
Last seen:	2020-11-05 22:59:16 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:vGr27eTj8G9B4nQnlZqHXQPFqN3V6QDgSVklvLM7ynFS:ly4nQnTXPwNl62VklvL0ynF
Threatray	1'298 similar samples on MalwareBazaar
TLSH	A9F4020F77274563CD98AB34D843A3A02F34EA8114B48F6B3ED6EF9E39B65541C42269
Reporter	abuse_ch
Tags:	exe RAT RemcosRAT

abuse_ch

RemcosRAT C2:
178.238.229.54:24311

Intelligence

File Origin

# of uploads :

# of downloads :

170

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Remcos

Link:

https://www.capesandbox.com/analysis/81420/

Detection(s):

SecuriteInfo.com.Trojan.PackedNET.453.22766.6157.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a window

Launching a process

Creating a file

Sending a custom TCP request

Reading critical registry keys

Creating a file in the %temp% directory

Deleting a recently created file

Forced shutdown of a system process

Stealing user critical data

Unauthorized injection to a system process

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Remcos

Detection:

malicious

Classification:

phis.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/517480

Signature

Contains functionality to capture and log keystrokes

Contains functionality to inject code into remote processes

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Detected Remcos RAT

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Sigma detected: Remcos

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file access)

Tries to steal Mail credentials (via file registry)

Writes to foreign memory regions

Yara detected Remcos RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a351faaa23105c8fde3cada56019c460dd7bc8579e027dfb56ef630e0b8649c5/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-10-31 06:51:03 UTC

AV detection:

22 of 29 (75.86%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=uni7vkrdcboi7xr4vwswagoemdoxxscxtybh362w55rq4c4gjhcq._file

Verdict:

malicious

Label(s):

remcos

RemcosRAT

2aca994114835d2663353454df341285535994068284d9cbbb03e2e87f388b80

RemcosRAT

3270cfe3f15d8303d43e64e082d89eabb0737af61637393ed6d4922c3cba3909

RemcosRAT

4a024542511c7d0a40e8317486b7177eaf71ee355f1731f17bc632731ea814b0

RemcosRAT

5a418e084b49b740a94d307baf45d67ac25db462fdeb80065fb60ffeb197273f

RemcosRAT

6637c089017af9c448d8235e20db32603d8547f0611187341cf184dc66c170b4

RemcosRAT

95167e64d46e5f0e9821b379aa7e412f57d14fe11e613bdcab38cb47dc217bbc

RemcosRAT

958139fdff65190d5ec118b4ac6ceec3a2d4b69932e72edb4ce6ae308ba13f47

RemcosRAT

b4b5110b2babce8946d262e6f75215f1c7a6f036eeb3eda5223b9430d5235d46

RemcosRAT

e037b5ebac7b3ac81b3e268268dbd072784c73f178662e4a66e5e57d7e8a67c3

RemcosRAT

+ 1'288 additional samples on MalwareBazaar

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos rat spyware

Link:

https://tria.ge/reports/201031-trapqf4arx/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Reads user/profile data of web browsers

Remcos

Malware Config

C2 Extraction:

178.238.229.54:24311

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a351faaa23105c8fde3cada56019c460dd7bc8579e027dfb56ef630e0b8649c5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_RemcosRAT Create hunting rule
Author:	abuse.ch

Rule name:	Chrome_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Chrome in files like avemaria

Rule name:	Keylog_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Contains Keylog

Rule name:	Parallax Create hunting rule
Author:	@bartblaze
Description:	Identifies Parallax RAT.

Rule name:	Remcos Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Remcos in memory

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator