MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a753b7719e1c51766bd58e946995f4654d427874d1bd315bf4f3f090b684c54e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a753b7719e1c51766bd58e946995f4654d427874d1bd315bf4f3f090b684c54e
SHA3-384 hash: db12f9a2857aa3ea25bb40c439db3ee89c98db20182b6f7b4a9038d0c7a8e7a63ad6793f8c50f65b10404cc84bbef0d0
SHA1 hash: fb998aeecad549bfdae8ad7fb2334509213ffb8a
MD5 hash: 241f09fd11e934e93072fcbcebe4f749
humanhash: nebraska-sixteen-angel-thirteen
File name:a753b7719e1c51766bd58e946995f4654d427874d1bd315bf4f3f090b684c54e
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:358'400 bytes
First seen:2020-06-29 07:27:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 3072:1sr9CM2HvtzU9e1RMsx8zCSX2hcEDvG0rgvQiSYnCxztK6b8f55EOTI7jGfApa2C:A8M2HFTMaCXGGEDdiZaztm5U7Smc
Threatray 776 similar samples on MalwareBazaar
TLSH 9C747BEC7B94D696E98E007BA9593D30D0D98B36B5DE401792F0B06DC3BC34AD291F4A
Reporter JAMESWT_WT
Tags:RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/15636/
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a753b7719e1c51766bd58e946995f4654d427874d1bd315bf4f3f090b684c54e/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-25 23:13:03 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=u5j3o4m6drixm26vr2kgtfpumvgue6du2g6tcw7u6pyjbnueyvha._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
0b82d3d29091a908e27761d0869fcf5b77a66bb7c7f3975eec0565af0bf990af
RemcosRAT
1475079e680cf10d802747d44fe9855d1d4b2ca97e637ae32b68d8a7dca8c722
RemcosRAT
5bddffdbdadb3f5d1f08cb87b5227b914d7e844b2fb3b626d1fa42dda37f182d
RemcosRAT
a01d4a1b86c5cef8726cc8f8c26a93739f10d1f68d101f9d2d94302dc248704e
RemcosRAT
aeaf83e513f357bf42bfe176f3706029604e3012b92a57fe4e7c83f5450175d9
RemcosRAT
bea9e2a9203714ee45ea07d53a3d3a2c645e95a037ec5f1442c117f5817d7715
RemcosRAT
c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b
RemcosRAT
e6e2a0f4f64aa78699c8e7e56f33c391d085e655a8a0579f5fa43c42cd580ca7
RemcosRAT
e9f5d1803a1896c7be53cd2e992b02b08e493eff811ca84b22f0792b482547b1
RemcosRAT
f5e9c92a15746fdf49171ed78dbea3250cefe1beeffe6c6f706d8241d3f60739
RemcosRAT
+ 766 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
rat family:remcos
Link:
https://tria.ge/reports/200629-y8j2wcks72/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of SetThreadContext
Remcos
Malware Config
C2 Extraction:
rock.extrafive.loan:8112
film.royalprop.trade:8113
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_RemcosRAT
Create hunting rule
Author:abuse.ch
Rule name:Remcos
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Remcos in memory
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/15636/

Comments