MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 ac7d008a3ac44bc8dfe3edbbc8542ed5b51bcf911b67eb8e9a715ebb5250ad27. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RemcosRAT
Vendor detections: 12
| SHA256 hash: | ac7d008a3ac44bc8dfe3edbbc8542ed5b51bcf911b67eb8e9a715ebb5250ad27 |
|---|---|
| SHA3-384 hash: | 5a88329d60b927b06edbf674007c845afdc1fcacade94081ea3f66e8b5cf55bf1e483f1a41d4b16d4c02f79a1929b199 |
| SHA1 hash: | f7bab7e57abc76ad116df9ca5dac1e021b66dedf |
| MD5 hash: | 06bcce73c5aa479588c2408f2f075e66 |
| humanhash: | chicken-august-utah-massachusetts |
| File name: | 06bcce73c5aa479588c2408f2f075e66.exe |
| Download: | download sample |
| Signature | RemcosRAT |
| File size: | 494'080 bytes |
| First seen: | 2021-03-31 19:50:39 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'453 x Formbook, 12'202 x SnakeKeylogger) |
| ssdeep | 12288:CpcJrwoIc0ZKaH1fmEgYG2hmKsWdgJjvPyKh5G:CIrwoIc0ZKaH1rJ9hFsWdKjXB5 |
| Threatray | 1'677 similar samples on MalwareBazaar |
| TLSH | 92B4DFF4B548CDE1E95E02F99819A41113B4E3E95063CB0D56DAF9762CB3F4E0CCA68B |
| Reporter |  abuse_ch |
| Tags: | exe RAT RemcosRAT |
Indicators Of Compromise (IOCs)
Below is a list of indicators of compromise (IOCs) associated with this malware samples.
| IOC | ThreatFox Reference |
|---|---|
| 103.147.184.53:7070 | https://threatfox.abuse.ch/ioc/6328/ |
Intelligence
File Origin
# of uploads :
1
# of downloads :
113
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
06bcce73c5aa479588c2408f2f075e66.exe
Verdict:
Malicious activity
Analysis date:
2021-03-31 19:57:27 UTC
Tags:
rat remcos trojan
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Creating a file
Running batch commands
Creating a process from a recently created file
Unauthorized injection to a recently created process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
remcos
Threat name:
Win32.Packed.Generic
Status:
Suspicious
First seen:
2021-03-30 22:21:11 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
22 of 47 (46.81%)
Threat level:
1/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
remcos
Similar samples:
+ 1'667 additional samples on MalwareBazaar
Result
Malware family:
remcos
Score:
10/10
Tags:
family:remcos rat
Behaviour
Creates scheduled task(s)
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Executes dropped EXE
Remcos
Malware Config
C2 Extraction:
103.147.184.53:7070
Unpacked files
SH256 hash:
b07d5bd9cbff775b25da777948365a98ba79c6f2eec53a4f2c6b0eeead3f2659
MD5 hash:
dc6d2f36f04ef6e13c56159d21310358
SHA1 hash:
024e5f7d5fdd56572478d221739c72b4d21674d0
SH256 hash:
8e82873f4ce23d5bc8a2f0eeba1be73f2645e5b2fb0edef012bd504a1796ccd7
MD5 hash:
529f08851fdb8c0fabee3f807c172ca0
SHA1 hash:
75c1780b997ca1387d3b03f4cfb8c86b12f9dbef
Detections:
win_remcos_g0
win_remcos_auto
SH256 hash:
1f716f02d729f30b7efe7ec2c242e6e07d2504ffc7160376af384bd3ffdfc5ed
MD5 hash:
10bc23678d7beb3efc4fa597ff5ea8c1
SHA1 hash:
d8a76dfc2de1de5b032d8480c34b1a56499aaee3
SH256 hash:
ac7d008a3ac44bc8dfe3edbbc8542ed5b51bcf911b67eb8e9a715ebb5250ad27
MD5 hash:
06bcce73c5aa479588c2408f2f075e66
SHA1 hash:
f7bab7e57abc76ad116df9ca5dac1e021b66dedf
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | Chrome_stealer_bin_mem |
|---|---|
| Author: | James_inthe_box |
| Description: | Chrome in files like avemaria |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer |
|---|---|
| Author: | ditekSHen |
| Description: | detects Windows exceutables potentially bypassing UAC using eventvwr.exe |
| Rule name: | Keylog_bin_mem |
|---|---|
| Author: | James_inthe_box |
| Description: | Contains Keylog |
| Rule name: | Remcos |
|---|---|
| Author: | JPCERT/CC Incident Response Group |
| Description: | detect Remcos in memory |
| Rule name: | remcos_rat |
|---|---|
| Author: | jeFF0Falltrades |
| Rule name: | REMCOS_RAT_variants |
|---|
| Rule name: | win_remcos_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | autogenerated rule brought to you by yara-signator |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.