MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c0dca118ea20025a93842b95e56eb6976f6c5d9a73c58132938fffc531279ba8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c0dca118ea20025a93842b95e56eb6976f6c5d9a73c58132938fffc531279ba8
SHA3-384 hash: d9d67dbf7d1cd319afe88927f9fbcad0ba9b145ecf47c1129c26951ee19a890512be2506dc9bad504b069cb6e7d10349
SHA1 hash: d3668c0a799828f4ad0f94dee213267fa10375ac
MD5 hash: eaabcf74268596fe0a22dd32c7e2324d
humanhash: earth-alaska-september-alaska
File name:ups.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:796'162 bytes
First seen:2020-05-07 21:16:29 UTC
Last seen:2020-05-07 22:04:46 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ebfe1b80a2b16c891f090e59c5d49378 (2 x RemcosRAT, 2 x AveMariaRAT)
ssdeep 12288:2fUo0e4kMU/NOJF19U9aZqr18iN1uwIoVBXiDjN5dLro6gVZVglUSamHZsCNRsWU:oU96dNOz15Zqr1t3IoTy1C2lGm5sb
Threatray 89 similar samples on MalwareBazaar
TLSH 9D058E23F6914437D16325785C1B97B95936BE203A68B88A3BF43E4C4F3A7813939397
Reporter James_inthe_box
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
4
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-07 21:16:01 UTC
File Type:
PE (Exe)
Extracted files:
40
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ydokcghkeabfve4efok6k3vws5xwyxm2opcycmutr774kmjhtoua._file
Verdict:
malicious
Similar samples:
1d96c4054a597e4b08abadd77dfea8f43f2ef65737052504b32f6eb8775c136c
RemcosRAT
4b13bb36220d46ab9fa89c4163c8ec571fe0c113af00773d0968fa51c4056bbd
RemcosRAT
67e4afe6e9701d2970eb3b62da0676750ba3e861801414f2036f3ec039b2e56b
RemcosRAT
76b79ad15a0d32493a1b45c4e254ea349ef56a1da3d541d55240b1e620278c72
RemcosRAT
76eab867aae0dcb9ec96ed5fca30fc051ac776981fa997c0b2b0e09905932aa6
RemcosRAT
8f0ce7232480a5ed7ef09cae8d6b61350835649ed50080b0b6c814bc15e12481
RemcosRAT
9c62d911a4efd2a37364d26439085d493ca2ab7e4b0fa90ba2f5d937e99e5bdf
RemcosRAT
b833d79953fe177a48a5832ce2606c41d00f0d5b9bd31ceb25d3055a3850c2f7
RemcosRAT
da550540689b015b44a2e03f37c23ed8c8730ccf9cb611490dc76a39782dce2b
RemcosRAT
dafacf05b19728eabbfec62b925b2cf60d81a4eeb634836da058d81faed7ca74
RemcosRAT
+ 79 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-av2kwsmkd6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Legitimate hosting services abused for malware hosting/C2
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_RemcosRAT
Create hunting rule
Author:abuse.ch
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments