MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c3c9aff6dc79b5e5b273e0df686f7896cae920de3ffd171cecdede3a1402725c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 12

Intelligence 12 IOCs YARA 8 File information Comments

SHA256 hash:	c3c9aff6dc79b5e5b273e0df686f7896cae920de3ffd171cecdede3a1402725c
SHA3-384 hash:	8c608751bccda9b234bdb5306fa0a08a14a5c20821c799d08c879d0571928424f5b3bacc0ad11349b5c9b0cdb78c3be4
SHA1 hash:	5fb396795652c36a5fde9693fa00a63537c1679b
MD5 hash:	99c2641c4aa7ce776ddc7a4b8172a715
humanhash:	oranges-blossom-berlin-video
File name:	99c2641c4aa7ce776ddc7a4b8172a715.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	126'976 bytes
First seen:	2020-11-28 11:14:22 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	5f0c90c109d16124e83cb7a25caef54f (28 x RemcosRAT, 1 x FormBook, 1 x NetWire)
ssdeep	3072:mJgk9sZwnSD9Pb0CR36oWdHZ8xyicFtsnal5OzqhPT9tn:ygk9EySD9z0CjeHyxyicFtsnavOzqhPj
Threatray	1'183 similar samples on MalwareBazaar
TLSH	5AC3E867F24B80A3D863037056507B72ADBCBC321A5D5157E7E8D8811DF588E902AAFF
Reporter	abuse_ch
Tags:	exe RAT RemcosRAT

abuse_ch

RemcosRAT C2:
qnb.mooo.com:61514 (193.181.35.204)

Intelligence

File Origin

# of uploads :

# of downloads :

231

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Remcos

Link:

https://www.capesandbox.com/analysis/105919/

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Sending a custom TCP request

Sending a UDP request

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Remcos

Detection:

malicious

Classification:

rans.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/550070

Signature

Antivirus / Scanner detection for submitted sample

Contains functionality to capture and log keystrokes

Contains functionality to inject code into remote processes

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Contains functionalty to change the wallpaper

Detected Remcos RAT

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Remcos

Yara detected Remcos RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

remcos

Link:

https://mwdb.cert.pl/sample/c3c9aff6dc79b5e5b273e0df686f7896cae920de3ffd171cecdede3a1402725c/

Threat name:

Win32.Trojan.Rescoms

Status:

Malicious

First seen:

2020-11-28 11:15:08 UTC

AV detection:

26 of 29 (89.66%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ype275w4pg26lmtt4dpwq33ys3fosig6h76rohhm33pdufacojoa._file

Verdict:

malicious

Label(s):

remcos

RemcosRAT

28e5fa8a71a61c9a963340efa4179b8e1e966eca430c77f86c5795a28b66162a

RemcosRAT

3bdfaf82d5d56f2546be44b3355f8d72cc0508984586e0fba3d704a5adabf7d1

RemcosRAT

5623d23f830311afc91586eeae9824ede5dd4233d9b45a45a6bea4110514db48

RemcosRAT

84440675af619c4edf18154e689b89143bae8581ccdfd4ee0385c50886f8c006

RemcosRAT

8e99ebae5c7d8b8620f20ff54a24db4d15c817f24e2a3017525063a34308bf60

RemcosRAT

9a40f0300c23e940e1e6abdab04d0d52218ac9a28b96075238de1fb9acd88b77

RemcosRAT

c381d8cd8db61a6517450b92e3757d4eae36518580a3d2f4761522d0b7b3f4f0

RemcosRAT

c97b88ff9779d0ba8c1f0cd066bc87588cfb203cb2a922d6b52769622209e96d

RemcosRAT

dce0fd32e1a722b27a3d60dc55016edbbfe763d3ec5aa10de6a6455e062b1432

RemcosRAT

+ 1'173 additional samples on MalwareBazaar

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos rat

Link:

https://tria.ge/reports/201128-kssq62xeyn/

Behaviour

Remcos

Malware Config

C2 Extraction:

qnb.mooo.com:61514

Unpacked files

SH256 hash:

c3c9aff6dc79b5e5b273e0df686f7896cae920de3ffd171cecdede3a1402725c

MD5 hash:

99c2641c4aa7ce776ddc7a4b8172a715

SHA1 hash:

5fb396795652c36a5fde9693fa00a63537c1679b

Detections:

win_remcos_g0

win_remcos_auto

Link:

https://www.unpac.me/results/6cdfd0ca-4d3c-4bef-9907-0aad3cf7d571/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Remcos

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c3c9aff6dc79b5e5b273e0df686f7896cae920de3ffd171cecdede3a1402725c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_RemcosRAT Create hunting rule
Author:	abuse.ch

Rule name:	Chrome_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Chrome in files like avemaria

Rule name:	Keylog_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Contains Keylog

Rule name:	Parallax Create hunting rule
Author:	@bartblaze
Description:	Identifies Parallax RAT.

Rule name:	Remcos Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Remcos in memory

Rule name:	remcos_rat Create hunting rule
Author:	jeFF0Falltrades

Rule name:	REMCOS_RAT_variants Create hunting rule

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator