MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a9bb3e9f775ca73baaac71ef7e7b4a5d7c467aef99d3b8f34856f16dbb3afe26. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 8

Intelligence 8 IOCs YARA 9 File information Comments

SHA256 hash:	a9bb3e9f775ca73baaac71ef7e7b4a5d7c467aef99d3b8f34856f16dbb3afe26
SHA3-384 hash:	af4c85f90b45de733c62d1f142341ad044749d993cb6a917e7e7298fd91bfef8ef95283e8bd5fff01eb5d3efb47cd359
SHA1 hash:	9bc0f14230a8439566d69caa5ddd730b946afbc8
MD5 hash:	ba0fba7f60adab31a07ee0b8707164ef
humanhash:	alpha-mike-pennsylvania-tennessee
File name:	Dhl Delivery Shipping Cargo, PDF.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	1'140'736 bytes
First seen:	2021-01-18 07:11:25 UTC
Last seen:	2021-01-18 08:50:33 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'655 x AgentTesla, 19'464 x Formbook, 12'205 x SnakeKeylogger)
ssdeep	24576:wtVPf/55p6dJxdsXQYrrrndnnONTwxFAoSUEfS:wtx/5OdJxOvrrndnqcxFAozt
Threatray	77 similar samples on MalwareBazaar
TLSH	A8359D1053DC9F20E3BC56F8A910826067E9E546F658E77CF9BEA0C25F61CA449DFB80
Reporter	abuse_ch
Tags:	DHL exe nVpn RAT RemcosRAT

abuse_ch

Malspam distributing RemcosRAT:

HELO: vps.asswart.com
Sending IP: 45.85.90.28
From: Dhl delivery <delivey@dhl.com>
Subject: Re: DHL Shipping Notification AWB
Attachment: Dhl Delivery Shipping Cargo, PDF.iso (contains "Dhl Delivery Shipping Cargo, PDF.exe")

RemcosRAT C2:
mikegrace2021.ddns.net:1999 (185.244.30.18)

Pointing to nVpn:

% Information related to '185.244.30.0 - 185.244.30.255'

% Abuse contact for '185.244.30.0 - 185.244.30.255' is 'abuse@privacyfirst.sh'

inetnum: 185.244.30.0 - 185.244.30.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-HU
country: HU
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2019-10-29T14:10:27Z
last-modified: 2020-10-07T21:39:48Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

106

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Dhl Delivery Shipping Cargo, PDF.exe

Verdict:

No threats detected

Analysis date:

2021-01-18 07:17:20 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/455334d9-a890-4d5a-bbf0-2132d12cc176

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Remcos

Link:

https://www.capesandbox.com/analysis/112403/

Detection(s):

SecuriteInfo.com.Artemis.29306.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Result

Threat name:

Remcos

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/583352

Signature

.NET source code contains potential unpacker

Contains functionality to capture and log keystrokes

Contains functionality to inject code into remote processes

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Detected Remcos RAT

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Sigma detected: Remcos

Sigma detected: Scheduled temp file as task from temp location

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses dynamic DNS services

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected AntiVM_3

Yara detected Remcos RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

remcos

Link:

https://mwdb.cert.pl/sample/a9bb3e9f775ca73baaac71ef7e7b4a5d7c467aef99d3b8f34856f16dbb3afe26/

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=vg5t5h3xlsttxkvmohxx462klv6em6xpthj3r42ik3yw3oz27yta._file

Verdict:

unknown

RemcosRAT

19f8a9328f40f5e0bafda9ceaf06920ed38348754b764caa8bf6d4708d9b8310

RemcosRAT

2255f606bd8106d016b35f64b77ac5bdea231121f5f290d19a81c900d40b2b68

RemcosRAT

4dd37816386e3f57fac01c9f6504b48231324563ca07ddf888aaff0676301150

RemcosRAT

518b609db6d3fb679e4344c2d410eebe9cc5398d19c4dd82eafb250f199c93cc

RemcosRAT

61248c209119bd790c6ad906dd9d12e7a03455c2b2f6e4b7d1432aed6ae92439

RemcosRAT

7326dddf5871d9ea2a91b0698527b830bb819e899f3eeabf9d46bb4d1c6d0af9

RemcosRAT

96ab02f3be7ce8006238114ea3435f000432c12b03a5e003de729a3e809df3d3

RemcosRAT

9972434ebdd96cf98cbc8849f08d6ca3120e5cf2553b3416bc0fccc5396c74b5

RemcosRAT

d7f09eb72021576518b37cce8a29aede8b3e49ec827a3f63e54bf1850eb93243

RemcosRAT

+ 67 additional samples on MalwareBazaar

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos rat

Link:

https://tria.ge/reports/210118-xjf8wrr7qx/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Remcos

Malware Config

C2 Extraction:

mikegrace2021.ddns.net:1999

Unpacked files

SH256 hash:

1d6ecf546163882d34d4bb2b7afa3889506ca3036ed536c4ed972ed89bdf5035

MD5 hash:

fb169513679d349cb2a7e4121bacfd4a

SHA1 hash:

26619d7ce0a175b9fc4fbfd7f4b105050562924f

Link:

https://www.unpac.me/results/081e44bc-5327-4b1f-aa01-6c8ef50a0ca7/

SH256 hash:

a9bb3e9f775ca73baaac71ef7e7b4a5d7c467aef99d3b8f34856f16dbb3afe26

MD5 hash:

ba0fba7f60adab31a07ee0b8707164ef

SHA1 hash:

9bc0f14230a8439566d69caa5ddd730b946afbc8

Link:

https://www.unpac.me/results/081e44bc-5327-4b1f-aa01-6c8ef50a0ca7/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a9bb3e9f775ca73baaac71ef7e7b4a5d7c467aef99d3b8f34856f16dbb3afe26

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_RemcosRAT Create hunting rule
Author:	abuse.ch

Rule name:	Chrome_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Chrome in files like avemaria

Rule name:	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer Create hunting rule
Author:	ditekSHen
Description:	detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Rule name:	Keylog_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Contains Keylog

Rule name:	Parallax Create hunting rule
Author:	@bartblaze
Description:	Identifies Parallax RAT.

Rule name:	Remcos Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Remcos in memory

Rule name:	remcos_rat Create hunting rule
Author:	jeFF0Falltrades

Rule name:	REMCOS_RAT_variants Create hunting rule

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator