MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 b782581b1ca3da09fdf3ecbb173ee3ca1f313f5f325f407df976601cad8ce839. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RemcosRAT
Vendor detections: 10
| SHA256 hash: | b782581b1ca3da09fdf3ecbb173ee3ca1f313f5f325f407df976601cad8ce839 |
|---|---|
| SHA3-384 hash: | a36ff1037deb23b58217eb445c5a518c339999accd98163eb4794eba3207c173ad0ab0a51556f0307269efa3d8cf7937 |
| SHA1 hash: | f29c3c60e4281577b6fe65073160a1f560f71c2a |
| MD5 hash: | 40816f91fa4c2ea57edd6933dbf5b1b8 |
| humanhash: | bravo-happy-california-alaska |
| File name: | PO AR483-1590436 FOR J-3000433707 PROJT.exe |
| Download: | download sample |
| Signature | RemcosRAT |
| File size: | 1'156'936 bytes |
| First seen: | 2021-03-02 07:47:25 UTC |
| Last seen: | 2021-03-02 14:33:20 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | fa25291894013102f014c94861e7259a (5 x RemcosRAT, 2 x AgentTesla, 2 x Loki) |
| ssdeep | 12288:4R61okjK9imvFqzAUC9AXVA9eQqcYcST6EAmWv13bGPlbX2dypFAu40CZLCRuCM:4cw9isFqznC9SAsQ7m8dGPfFAu40S |
| Threatray | 202 similar samples on MalwareBazaar |
| TLSH | E7357C91E3434876D57717398C3A5E35582ABE116939E58E3AADBC3C1FF72C2242324B |
| Reporter |  abuse_ch |
| Tags: | exe RemcosRAT |
abuse_ch
Malspam distributing unidentified malware:HELO: hosted-by.rootlayer.net
Sending IP: 185.222.57.246
From: "Deepak Jadhav H.R.G" <purchase1@aquavalv.com>
Subject: RV: PO /AR483-159043 & PO /AR483-1590436 FOR J-3000433707 PROJT
Attachment: PO AR483-1590436 FOR J-3000433707 PROJT.r00 (contains "PO AR483-1590436 FOR J-3000433707 PROJT.exe")
Intelligence
File Origin
# of uploads :
2
# of downloads :
126
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SOA AFRI SHALIHA - MARAKISH Updated.exe
Verdict:
Malicious activity
Analysis date:
2021-03-02 08:06:06 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a UDP request
DNS request
Sending a custom TCP request
Creating a file
Deleting a recently created file
Launching a process
Reading critical registry keys
Creating a file in the %temp% directory
Creating a file in the %AppData% subdirectories
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Setting a global event handler for the keyboard
Stealing user critical data
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Remcos
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to steal Firefox passwords or cookies
Creates a thread in another existing process (thread injection)
Delayed program exit found
Detected Remcos RAT
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected Remcos RAT
Yara detected WebBrowserPassView password recovery tool
Behaviour
Behavior Graph:
Threat name:
Win32.Infostealer.Fareit
Status:
Malicious
First seen:
2021-03-02 06:25:56 UTC
AV detection:
11 of 47 (23.40%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 192 additional samples on MalwareBazaar
Result
Malware family:
remcos
Score:
10/10
Tags:
family:remcos persistence rat
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
NirSoft WebBrowserPassView
Nirsoft
Remcos
Malware Config
C2 Extraction:
tulicknewfavour.ddns.net:4033
Unpacked files
SH256 hash:
d1f0293349ad4591df80151cd2f6e2ad82dd525dce362ddd12ad5fee68bbc847
MD5 hash:
35ec36fe55e56e6e748a5cdfe5ad906c
SHA1 hash:
eaf3539ea4e29217be3f6f5de98e48cbe1acc137
SH256 hash:
e4f24d6c095cd14f29cc45fcaf83ca215b312190db47e885ab928bc4146648bd
MD5 hash:
4affbf95497aa0c581bddea142c12c95
SHA1 hash:
803da67530de4eb5f73c8c4b8d1b01bfbc54eefc
SH256 hash:
5bcde4d165f66f58ce0446462a038b7ae84e2fd2275885f61f68287547aac66d
MD5 hash:
34cb499bbd566c24dcf888e9bab46083
SHA1 hash:
3bb97e3103868691e57e7cf3be88a7ff30f46ea1
SH256 hash:
341ef2ca81eebbb4471a6b85b9207a37dc29a358c2b7e399c44c936ed92a1b16
MD5 hash:
4e13746ff1035d5bb59c46f236268c6d
SHA1 hash:
0eb3e9f72a36e873a535cd07e125f65b54665a97
SH256 hash:
b782581b1ca3da09fdf3ecbb173ee3ca1f313f5f325f407df976601cad8ce839
MD5 hash:
40816f91fa4c2ea57edd6933dbf5b1b8
SHA1 hash:
f29c3c60e4281577b6fe65073160a1f560f71c2a
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.