MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c4417a6bdfb8727b6cb186c09a2e3700ec563324bb60d22544a6ee5b8a2eda29. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 10

Intelligence 10 IOCs YARA 9 File information Comments

SHA256 hash:	c4417a6bdfb8727b6cb186c09a2e3700ec563324bb60d22544a6ee5b8a2eda29
SHA3-384 hash:	7c1c9f6bf237df81d6d44e6071523b221d67a0aed727b4456a770b4beca407d900c0830ae0c1a0b79c9f73026822af3d
SHA1 hash:	e41fe09800bbb814bc1dc3a085e6ab8f353ad487
MD5 hash:	ab1a5076f4e4c8a3e7b63602abeacfc3
humanhash:	wyoming-blue-maine-ack
File name:	lC75W1CoWmAaCKA.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	610'816 bytes
First seen:	2020-10-20 08:32:39 UTC
Last seen:	2020-10-26 08:34:20 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	12288:BjLFe0Osk2iNwRLIqKZONDwX01UO1P2jFROZUt:BqF1S0qyp0ojS
Threatray	925 similar samples on MalwareBazaar
TLSH	5ED4DF7123F89F65E03E57790430A1408FF1A457D7A2DAA97ECC52AE4F26B824B33712
Reporter	abuse_ch
Tags:	exe RAT RemcosRAT UPS

abuse_ch

Malspam distributing RemcosRAT:

HELO: mysmtp3
Sending IP: 40.91.70.93
From: UPS Customer Service <pkinfo@ups.com>
Subject: UPS - Package Arrival Notification
Attachment: UPS Detail.img (contains "lC75W1CoWmAaCKA.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Detection(s):

SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Adding an access-denied ACE

Creating a file in the %temp% directory

Launching a process

Creating a process with a hidden window

Deleting a recently created file

Unauthorized injection to a recently created process

Creating a file

DNS request

Setting a global event handler for the keyboard

Connection attempt to an infection source

Enabling autorun by creating a file

Result

Threat name:

Remcos

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/497365

Signature

Contains functionality to capture and log keystrokes

Contains functionality to inject code into remote processes

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Detected Remcos RAT

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Sigma detected: Scheduled temp file as task from temp location

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses dynamic DNS services

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected AntiVM_3

Yara detected Remcos RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

remcos

Link:

https://mwdb.cert.pl/sample/c4417a6bdfb8727b6cb186c09a2e3700ec563324bb60d22544a6ee5b8a2eda29/

Threat name:

ByteCode-MSIL.Backdoor.Remcos

Status:

Malicious

First seen:

2020-10-20 02:46:36 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

26 of 29 (89.66%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=yraxu267xbzhw3frq3ajulrxadwfmmzexnqnejkeu3xfxcro3iuq._file

Verdict:

malicious

Label(s):

remcos

RemcosRAT

48f8e8504e89f98adb7acc7f938cb133b7d17a4acacdf1bf36dcc02abe51e87e

RemcosRAT

5b10f4a23880b51923a0df3e9e3c37f40eb0d3cc93de7b463da62f936a501385

RemcosRAT

61cd0eb067277dda91558901ac1d3b45bf56f4d4fec39270e4975de550477513

RemcosRAT

6c489ebc2d7b407a9058479ee3e54b83949ef2a58ce749528cea74b4f0b5db0e

RemcosRAT

ad8aeed2d546163aa0b5cbfb430bc9a02896645be4a51cb654083ce18ab853bb

RemcosRAT

b29880b2403337ef4fb3c644c4b033327cb6e2828d28799a0cc6a708cc0afaa4

RemcosRAT

c8946b73ca20ba2454e510f081a9d33d60d1ba9291471a0ba5abb649ff0d25d4

RemcosRAT

e5a94739fb1f6d7a06f6b9eb529037c9ab0d59be424d4b99c63651360d7ded3f

RemcosRAT

e6d2c97461c6aac9ea130eaa96f9927b57998c04b5e7573a555caa729178a70c

RemcosRAT

+ 915 additional samples on MalwareBazaar

Result

Malware family:

remcos

Score:

10/10

Tags:

rat family:remcos

Link:

https://tria.ge/reports/201020-qe73m6ea8x/

Behaviour

Creates scheduled task(s)

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Remcos

Unpacked files

SH256 hash:

0b66203eb389951e3be4a3032a6a74e66085cb6f52545203c0a6ae49456a114b

MD5 hash:

23bd300f0a0cae06f7ac104b41612a80

SHA1 hash:

119a908b7c339ad78cd61bb15e5a57bc212a06be

Link:

https://www.unpac.me/results/042739a8-bf63-4082-8ec5-480be7def6e4/

SH256 hash:

c1f3014efaf2118b11c25949e395c114ab71a7363fb2912875339b3191a938bc

MD5 hash:

4d22e69c7664bdadfaacf22ea9cd43e2

SHA1 hash:

a66ba2f18dad08b883efd6eb7403fd219921490f

Detections:

win_remcos_g0

win_remcos_auto

Link:

https://www.unpac.me/results/042739a8-bf63-4082-8ec5-480be7def6e4/

Parent samples :

8698337edbeaff1bcd719babffa69ff876d5ee74349886e5cba349b7cae7e19f
1a1924da9d272ea46f8a0a62d7e2ecf01746e9a7621c8b1c36950788c3a3bd8c
73034f52ab0662e125659b9771ecd27259b03e3635fbeda5d7252f53fb2bbc7f
d9eeb6c02f3837b46eafecd72f433a538511cf6280b8238a76baa6a55be2c856
bd4ef5e45ec6e18bc4fc2225588ea4d01151f8f82aeb073a75868bdbcfc66b5a
c4417a6bdfb8727b6cb186c09a2e3700ec563324bb60d22544a6ee5b8a2eda29
a7154f13f8a8a66f47afafe4099e6e760aef60af8eb8d66de0d8ee83cfe1ef8b
a01cd6294d3b5bdf73771b113493d8a5c2df3f105db7d084b0729345a32a4453
5cad6293fe826e616a0ff23c931f174e22fd52fafd874a038419e8dad3681fd6
f2a8ae610f1847b1344ffaa1c252543a9e4f5208b0644be9d8f5d7d6770c9ae2
b5734fe9e898335433674437790e741440b75c6a749ceb7455555c88303daedc
00b65900131d5d5cac9d48c65ff2e53677418d7c50f0c09480af43e80845bef3
1a6757ed0fa8dfc6a0ecc4dcfecc7dacb2b4ff435c15eefeb9edde8b913e1811
6da5a41c6dd6f0ddc638a3bccceeae8132814f605971a2f9eb1af58040f60eb8

SH256 hash:

c4417a6bdfb8727b6cb186c09a2e3700ec563324bb60d22544a6ee5b8a2eda29

MD5 hash:

ab1a5076f4e4c8a3e7b63602abeacfc3

SHA1 hash:

e41fe09800bbb814bc1dc3a085e6ab8f353ad487

Link:

https://www.unpac.me/results/042739a8-bf63-4082-8ec5-480be7def6e4/

SH256 hash:

bac5797bde4b2810766a40d95bcdb825ac5b395fcbadd139daa19a44a6cdc049

MD5 hash:

a92cc1f6e0a2742350dfda6726db14c0

SHA1 hash:

e5404e3ed46498deb8ad8966a774540c2b8e9c1e

Link:

https://www.unpac.me/results/042739a8-bf63-4082-8ec5-480be7def6e4/

SH256 hash:

c7e7f33f31d97c85cec693e3cb6286225144173f9d78b7038243de0d635ea9be

MD5 hash:

086e8953bcaad73346ad1f7c73444d51

SHA1 hash:

731de6bf3d9a0a0002a79303dffa14bb1b1023bf

Link:

https://www.unpac.me/results/042739a8-bf63-4082-8ec5-480be7def6e4/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c4417a6bdfb8727b6cb186c09a2e3700ec563324bb60d22544a6ee5b8a2eda29

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_RemcosRAT Create hunting rule
Author:	abuse.ch

Rule name:	Chrome_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Chrome in files like avemaria

Rule name:	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer Create hunting rule
Author:	ditekSHen
Description:	detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Rule name:	Keylog_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Contains Keylog

Rule name:	Parallax Create hunting rule
Author:	@bartblaze
Description:	Identifies Parallax RAT.

Rule name:	Remcos Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Remcos in memory

Rule name:	remcos_rat Create hunting rule
Author:	jeFF0Falltrades

Rule name:	REMCOS_RAT_variants Create hunting rule

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator