MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bd476af0520fd90f7899f5cf82e4d04aca5df43cbecab3416c54d202513fecbf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bd476af0520fd90f7899f5cf82e4d04aca5df43cbecab3416c54d202513fecbf
SHA3-384 hash: 270a79ae4207f46a35c618f99356552f75a5b8c06e6e388c29a16f1154deca0a81560cee0185a50a2c55d9458762c2c0
SHA1 hash: 762efaedda4977ff36420c0de05ac5e88935d2cc
MD5 hash: d0e3448a604a83cf21afaffba0eea4bd
humanhash: venus-coffee-tango-stream
File name:ĐẶT HÀNG MUA-34002174,pdf.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:392'243 bytes
First seen:2021-05-25 06:32:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 099c0646ea7282d232219f8807883be0 (476 x Formbook, 210 x Loki, 107 x AgentTesla)
ssdeep 6144:gsYeG0xkz6C2U/2aqg9JBP/H8POKr5BZvt5Pv1bd5ejpwqxA7iaz:BGlaKpH87VptbuN6
Threatray 1'795 similar samples on MalwareBazaar
TLSH 4784BF9174ACC0C7E1BE0DB2ADAEE63520E4399DE1C9504F3789B76A20B2392445F77D
Reporter abuse_ch
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
124
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/161673/
Detection(s):
PUA.Win.Trojan.Casino-141
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a process from a recently created file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/791207
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to capture and log keystrokes
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Detected Remcos RAT
Found malware configuration
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Dridex Process Pattern
Sigma detected: Suspicious Svchost Process
System process connects to network (likely due to code injection or exploit)
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 423607 Sample: #U0110#U1eb6T H#U00c0NG MUA... Startdate: 25/05/2021 Architecture: WINDOWS Score: 100 40 godgodgod.ddns.net 2->40 46 Found malware configuration 2->46 48 Malicious sample detected (through community Yara rule) 2->48 50 Multi AV Scanner detection for submitted file 2->50 52 6 other signatures 2->52 8 #U0110#U1eb6T H#U00c0NG MUA-34002174,pdf.exe 1 23 2->8         started        11 phqqqbsbjd.exe 18 2->11         started        signatures3 process4 file5 30 C:\Users\user\AppData\...\phqqqbsbjd.exe, PE32 8->30 dropped 32 C:\Users\user\AppData\Local\Temp\nsn5B8.tmp, COM 8->32 dropped 34 C:\Users\user\AppData\Local\...\System.dll, PE32 8->34 dropped 14 svchost.exe 8->14         started        17 #U0110#U1eb6T H#U00c0NG MUA-34002174,pdf.exe 19 8->17         started        36 C:\Users\user\AppData\Local\...\System.dll, PE32 11->36 dropped 38 C:\Users\user\AppData\Local\...\nss5DCB.tmp, COM 11->38 dropped 56 Multi AV Scanner detection for dropped file 11->56 58 Writes to foreign memory regions 11->58 60 Maps a DLL or memory area into another process 11->60 20 svchost.exe 11->20         started        signatures6 process7 file8 62 System process connects to network (likely due to code injection or exploit) 14->62 64 Contains functionality to steal Chrome passwords or cookies 14->64 66 Contains functionality to capture and log keystrokes 14->66 72 2 other signatures 14->72 26 C:\Users\user\AppData\Local\...\System.dll, PE32 17->26 dropped 28 C:\Users\user\AppData\Local\...\nsd1EDE.tmp, COM 17->28 dropped 68 Writes to foreign memory regions 17->68 70 Maps a DLL or memory area into another process 17->70 22 svchost.exe 2 17->22         started        signatures9 process10 dnsIp11 42 godgodgod.ddns.net 185.19.85.133, 49741, 49742, 49745 DATAWIRE-ASCH Switzerland 22->42 44 192.168.2.1 unknown unknown 22->44 54 System process connects to network (likely due to code injection or exploit) 22->54 signatures12
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/bd476af0520fd90f7899f5cf82e4d04aca5df43cbecab3416c54d202513fecbf/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2021-05-25 06:33:11 UTC
AV detection:
5 of 47 (10.64%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xvdwv4csb7mq66ez6xhyfzgqjlff35b4x3flgqlmktjaeuj75s7q._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
0690480dc368a8a85e260416d96fe9fd5db0e59fecba72923b45df8b3409e57e
RemcosRAT
0758013f642af55d429e3688886f60ed90633a19d87173c2488de6468599456c
RemcosRAT
0dbc7401908f4c77ba9380f1f1d04ee61734a6116331745cd09d88ac368a2736
RemcosRAT
32560ccc4af2d37c587bbc551e1dd8127b8efaafb199f74c18ec111a812a7f30
RemcosRAT
446fdd51f5eb4359191e189e54a209bd96295c5495cabc1b0b07c8f11d1eb748
RemcosRAT
6ce798e776cf4fdcf419958817fc139391ae804e1f47b12998312fd8cea6621f
RemcosRAT
8ef0ab64ef4a050f29808379fa8e9448bca73be60e4944f9d13a9a6880ba33f2
RemcosRAT
dae7b35835c65b3586481620e925d9c899997d0e1805a948c235b04c05eb201f
RemcosRAT
e7c74f89332dcf4bf0ebaa50d960a8c82a521ca2c9608ecbb13e719e9744b5ca
RemcosRAT
e894ebaa11758fde8fc97c450d7219fa914fd4f3fd90d438883223094b2bb3a3
RemcosRAT
+ 1'785 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/210525-yhn95djrt2/
Behaviour
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bd476af0520fd90f7899f5cf82e4d04aca5df43cbecab3416c54d202513fecbf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_RemcosRAT
Create hunting rule
Author:abuse.ch
Rule name:Chrome_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Chrome in files like avemaria
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:Parallax
Create hunting rule
Author:@bartblaze
Description:Identifies Parallax RAT.
Rule name:Remcos
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Remcos in memory
Rule name:remcos_rat
Create hunting rule
Author:jeFF0Falltrades
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_remcos_g0
Create hunting rule
Author:Daniel Plohmann <daniel.plohmann<at>fkie.fraunhofer.de>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Executable exe bd476af0520fd90f7899f5cf82e4d04aca5df43cbecab3416c54d202513fecbf

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/161673/

Comments