MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b5734fe9e898335433674437790e741440b75c6a749ceb7455555c88303daedc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 10

Intelligence 10 IOCs YARA 8 File information Comments

SHA256 hash:	b5734fe9e898335433674437790e741440b75c6a749ceb7455555c88303daedc
SHA3-384 hash:	f45d6a1a6b60b8ae0f6ab76c2ca24d127a6b55f58c1fb7ae43f795884fd3876ecc59eada6e7401285e1a7301ffb0625a
SHA1 hash:	a63be3e4081dd482028aaf1d5d0ccec24dd7a5d4
MD5 hash:	c0a636a325b7e9d9bf5af675dd9b6c3c
humanhash:	lemon-december-queen-papa
File name:	DHL.EXE
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	350'720 bytes
First seen:	2020-12-08 15:03:20 UTC
Last seen:	2020-12-10 07:11:34 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	fc181aa3184b4f72ff89db1425da6769 (1 x AgentTesla, 1 x RemcosRAT, 1 x Formbook)
ssdeep	3072:FkIW0dpyHSudbi1J0WOy7xuBvdAUfZ66HpZ3PnVX/p5qWLcG598eVaqCNvJl7Yp:OIPyHS0i1J0ZOuBVAUI6HTnhhmk9ZC5
Threatray	1'228 similar samples on MalwareBazaar
TLSH	DC7448842D40C8ADD161CFF228F185B3D72E6FED6E24986E3614FF7A1A741AD1760A13
Reporter	cocaman
Tags:	exe RemcosRAT

Intelligence

File Origin

# of uploads :

# of downloads :

138

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

DHL.EXE

Verdict:

Malicious activity

Analysis date:

2020-12-08 15:16:01 UTC

Tags:

rat remcos

Link:

https://app.any.run/tasks/1a2a5932-263b-47d6-ba98-f027e2106802

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/107279/

Detection(s):

SecuriteInfo.com.Trojan.KillProc2.14899.16646.12275.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a file in the %temp% subdirectories

Creating a file

Running batch commands

Unauthorized injection to a recently created process

DNS request

Launching a process

Creating a file in the %AppData% subdirectories

Enabling the 'hidden' option for recently created files

Setting a global event handler for the keyboard

Connection attempt to an infection source

Enabling autorun by creating a file

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Remcos

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/558055

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Contains functionality to capture and log keystrokes

Contains functionality to inject code into remote processes

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Detected Remcos RAT

Drops executable to a common third party application directory

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Uses dynamic DNS services

Yara detected Remcos RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b5734fe9e898335433674437790e741440b75c6a749ceb7455555c88303daedc/

Threat name:

Win32.Trojan.Graftor

Status:

Malicious

First seen:

2020-12-08 15:04:06 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

25 of 48 (52.08%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=wvzu72pitazvim3hiq3xsdtucraloxdkosoow5cvkvoiqmb5v3oa._file

Verdict:

malicious

Label(s):

remcos

RemcosRAT

2efa13d0516f3ee1dc4b80c718cda030cc66275d9f0d829371dd49ce1fe0d612

RemcosRAT

4f718a40662228b1b5efca4664eb07f6d1918b62bc8b29598410d1dc5bb76c70

RemcosRAT

570e5bb05a57a95438fe1f61a116ab1d0de2bb2b0703745adea8ff45780d4a57

RemcosRAT

83f54b46a10ce36ac80d885c29cbf1c88c65250163961193916123c282d36784

RemcosRAT

98d8bbdf43367821e74fd0c26f5bdda07fe9a750476cce1bb0df88c5aa18b745

RemcosRAT

b704ceb41947acea7cb7c2d1a5b3de33b25120728fec16b4d8b35fbaa05e5afb

RemcosRAT

bc8513a74ddfc1a9a78fbdbf39d90a61d59819dfb116846daf730693622c3c69

RemcosRAT

be9005c3def853773256e54e0d8f307a7cd323fa0e86b4691c6e8619b9632afd

RemcosRAT

fa5850a0ba8809631d4e3f5a3f8cafa133b3d6ae37088eeb934ec13d1bc9f368

RemcosRAT

+ 1'218 additional samples on MalwareBazaar

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos rat

Link:

https://tria.ge/reports/201208-4y5h93rv96/

Behaviour

Creates scheduled task(s)

Suspicious behavior: MapViewOfSection

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetThreadContext

Remcos

Malware Config

C2 Extraction:

u875414.nvpn.to:2404
u875414.duckdns.org:2404
u875414.ddns.net:2404
u875414.nsupdate.info:2404

Unpacked files

SH256 hash:

b5734fe9e898335433674437790e741440b75c6a749ceb7455555c88303daedc

MD5 hash:

c0a636a325b7e9d9bf5af675dd9b6c3c

SHA1 hash:

a63be3e4081dd482028aaf1d5d0ccec24dd7a5d4

Link:

https://www.unpac.me/results/55e42ca6-1258-464b-b57e-9e5c5b3ae9e2/

SH256 hash:

c1f3014efaf2118b11c25949e395c114ab71a7363fb2912875339b3191a938bc

MD5 hash:

4d22e69c7664bdadfaacf22ea9cd43e2

SHA1 hash:

a66ba2f18dad08b883efd6eb7403fd219921490f

Detections:

win_remcos_g0

win_remcos_auto

Link:

https://www.unpac.me/results/55e42ca6-1258-464b-b57e-9e5c5b3ae9e2/

Parent samples :

8698337edbeaff1bcd719babffa69ff876d5ee74349886e5cba349b7cae7e19f
1a1924da9d272ea46f8a0a62d7e2ecf01746e9a7621c8b1c36950788c3a3bd8c
73034f52ab0662e125659b9771ecd27259b03e3635fbeda5d7252f53fb2bbc7f
d9eeb6c02f3837b46eafecd72f433a538511cf6280b8238a76baa6a55be2c856
bd4ef5e45ec6e18bc4fc2225588ea4d01151f8f82aeb073a75868bdbcfc66b5a
c4417a6bdfb8727b6cb186c09a2e3700ec563324bb60d22544a6ee5b8a2eda29
a7154f13f8a8a66f47afafe4099e6e760aef60af8eb8d66de0d8ee83cfe1ef8b
a01cd6294d3b5bdf73771b113493d8a5c2df3f105db7d084b0729345a32a4453
5cad6293fe826e616a0ff23c931f174e22fd52fafd874a038419e8dad3681fd6
f2a8ae610f1847b1344ffaa1c252543a9e4f5208b0644be9d8f5d7d6770c9ae2
b5734fe9e898335433674437790e741440b75c6a749ceb7455555c88303daedc
00b65900131d5d5cac9d48c65ff2e53677418d7c50f0c09480af43e80845bef3
1a6757ed0fa8dfc6a0ecc4dcfecc7dacb2b4ff435c15eefeb9edde8b913e1811
6da5a41c6dd6f0ddc638a3bccceeae8132814f605971a2f9eb1af58040f60eb8

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Zbot

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b5734fe9e898335433674437790e741440b75c6a749ceb7455555c88303daedc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_RemcosRAT Create hunting rule
Author:	abuse.ch

Rule name:	Chrome_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Chrome in files like avemaria

Rule name:	Keylog_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Contains Keylog

Rule name:	Parallax Create hunting rule
Author:	@bartblaze
Description:	Identifies Parallax RAT.

Rule name:	Remcos Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Remcos in memory

Rule name:	remcos_rat Create hunting rule
Author:	jeFF0Falltrades

Rule name:	REMCOS_RAT_variants Create hunting rule

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator