MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c583fe59628fa5aa1146213fd49234db4509dc5cc451861c9b3a314b52d9a3e7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 10

Intelligence 10 IOCs YARA 6 File information Comments

SHA256 hash:	c583fe59628fa5aa1146213fd49234db4509dc5cc451861c9b3a314b52d9a3e7
SHA3-384 hash:	fe45b4be5da75b01152c44fd3c5c5c755efd0106dc6f5797492c70643d88473bb7239dfaad90abd8ef8cc42dc2221f92
SHA1 hash:	47e30d25e9e8ef87293fb0ee003b32dcf016ded7
MD5 hash:	39715318a6058464fe74a819d27db530
humanhash:	alaska-timing-seventeen-berlin
File name:	39715318a6058464fe74a819d27db530.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	659'968 bytes
First seen:	2020-11-05 18:42:16 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	12288:NgQgYmE0pAQ3bMM4zrKtcy3fR4fxJMh0DojplCV3Li09zDT:N+YmFAQ3zy+tcUR4fleu3
Threatray	1'032 similar samples on MalwareBazaar
TLSH	67E4E08CFB448A75DC2E02B06471491503317E7A65A197FE7AA9B6FA13F33902C13E67
Reporter	abuse_ch
Tags:	exe RAT RemcosRAT

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Remcos

Link:

https://www.capesandbox.com/analysis/83372/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file

Launching a process

DNS request

Sending a TCP request to an infection source

Unauthorized injection to a system process

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c583fe59628fa5aa1146213fd49234db4509dc5cc451861c9b3a314b52d9a3e7/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-11-05 18:44:05 UTC

AV detection:

21 of 29 (72.41%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ywb74wlcr6s2uekgee75jeru3ncqtxc4yriymhe3hiyuwuwzuptq._file

Verdict:

malicious

Label(s):

remcos

RemcosRAT

257b2b1a5694438c684e9d4fd44141fc3f09a18d15ebef5e46aad1603afa0b0c

RemcosRAT

2aca994114835d2663353454df341285535994068284d9cbbb03e2e87f388b80

RemcosRAT

3270cfe3f15d8303d43e64e082d89eabb0737af61637393ed6d4922c3cba3909

RemcosRAT

596802440276cf7c17a24c0f108f21647579ca06d6bd1299bea1b82d5121afa1

RemcosRAT

5a418e084b49b740a94d307baf45d67ac25db462fdeb80065fb60ffeb197273f

RemcosRAT

6637c089017af9c448d8235e20db32603d8547f0611187341cf184dc66c170b4

RemcosRAT

95167e64d46e5f0e9821b379aa7e412f57d14fe11e613bdcab38cb47dc217bbc

RemcosRAT

a351faaa23105c8fde3cada56019c460dd7bc8579e027dfb56ef630e0b8649c5

RemcosRAT

e037b5ebac7b3ac81b3e268268dbd072784c73f178662e4a66e5e57d7e8a67c3

RemcosRAT

+ 1'022 additional samples on MalwareBazaar

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos rat

Link:

https://tria.ge/reports/201105-mbjqpfsdax/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Remcos

Malware Config

C2 Extraction:

ndma.chickenkiller.com:31411

Unpacked files

SH256 hash:

c583fe59628fa5aa1146213fd49234db4509dc5cc451861c9b3a314b52d9a3e7

MD5 hash:

39715318a6058464fe74a819d27db530

SHA1 hash:

47e30d25e9e8ef87293fb0ee003b32dcf016ded7

Link:

https://www.unpac.me/results/c2a93870-f9bd-464b-a625-65cbc2f29c67/

SH256 hash:

145588e8ba10e4ad257a3fefa74fe9b258562e2225591b3d6e98271e79fdae55

MD5 hash:

2bee2191559157fa0aaa8bc8c29e0d36

SHA1 hash:

643370f85c66f304f3d200200a98e80b9aa5baed

Detections:

win_remcos_g0

win_remcos_auto

Link:

https://www.unpac.me/results/c2a93870-f9bd-464b-a625-65cbc2f29c67/

SH256 hash:

6ce101bb675194117043dc65d4b6bcc1af6e1d531ab8e513e13cd80e7b9c136d

MD5 hash:

f11ec1b5fc6350c55851b5f3de3949e0

SHA1 hash:

e93c0f49e61933430c543b95ce8abd7e94a31ad3

Link:

https://www.unpac.me/results/c2a93870-f9bd-464b-a625-65cbc2f29c67/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Kryptik

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c583fe59628fa5aa1146213fd49234db4509dc5cc451861c9b3a314b52d9a3e7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_RemcosRAT Create hunting rule
Author:	abuse.ch

Rule name:	Chrome_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Chrome in files like avemaria

Rule name:	Keylog_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Contains Keylog

Rule name:	Parallax Create hunting rule
Author:	@bartblaze
Description:	Identifies Parallax RAT.

Rule name:	Remcos Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Remcos in memory

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator