MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c85e13a5030bcd0c8173ef7ff6939690fe9638fa25d3c89cbf1e1e95a89db997. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c85e13a5030bcd0c8173ef7ff6939690fe9638fa25d3c89cbf1e1e95a89db997
SHA3-384 hash: fdc48f901be789efe5ce118539939a2bcae26c4ef4c34cf32304d65d178deb384c297251229b58c5ef1e6548d06569cf
SHA1 hash: 0e798075c1e2ec42d586875b2f0dfb3d0b714a03
MD5 hash: f676bf22aa34d361b8d0e5e132a8f8fe
humanhash: utah-alabama-arizona-delaware
File name:Halkbank_Ekstre_20200410_080918_330462.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:467'968 bytes
First seen:2020-05-13 10:59:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2830448e0168e921d7f350fbcdf737b0 (9 x AgentTesla, 3 x RemcosRAT, 3 x Loki)
ssdeep 12288:rwuGAp/gAZ3k+9JJQrm3g9KqtVnn4UBFJ3UBj:rntPZhrg+UzpUZ
Threatray 1'071 similar samples on MalwareBazaar
TLSH B1A49F26E7D08837C1A3293E9C4B67949837BE813D24DEC66FE91D4C5F393813929297
Reporter abuse_ch
Tags:exe geo Halkbank nVpn RAT RemcosRAT TUR


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: halkbank.com.tr
Sending IP: 199.119.151.199
From: halkbank.e-ekstre@halkbank.com.tr
Subject: T.HALK BANKASI A.S. 12.05.2020 - 13.05.2020 Hesap Ekstresi
Attachment: Halkbank_Ekstre_20200410_080918_330462.cab (contains "Halkbank_Ekstre_20200410_080918_330462.exe")

RemcosRAT C2:
185.244.30.28:8780

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 11:40:09 UTC
File Type:
PE (Exe)
Extracted files:
265
AV detection:
28 of 31 (90.32%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zbpbhjidbpgqzalt5577ne4wsd7jmoh2exj4rhf7dypjlke5xglq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
hawkeyekeylogger
Create hunting rule
emotet
Create hunting rule
Similar samples:
04e18fc32464a616b096a50a3ed43b646ece444e693b238a29d6f6de6ee45833
RemcosRAT
1aeb603dd60de76549e74fa97476865d66093fc0cd65b340b9d81b9e63875d91
RemcosRAT
292fdda313c6d03852ecd9487653eb15bdf8cf6412e814365c2f176a1104cbc3
RemcosRAT
3ce66a4e58b435bcd38a1272823e97f7beac54d679ff0af1224187f032360e87
RemcosRAT
54091d6f7893b5a42baebba2ea94def14f9181a46544633116be5f1772811236
RemcosRAT
56fee643ba39ac908309688827397099ca6b707c45154eb14da1b693f6b16571
RemcosRAT
7371e1b74410000cb35049d74ba9f63da63cabfc28f9aae86769136d7e435ad7
RemcosRAT
b55bd6825fe91af7f39a6db95cc72d531fae8edf94266dfcbf82d44fcf1e67c7
RemcosRAT
c851749fd6c9fa19293d8ee2c5b45b3dc8561115ddfe7166fbaefcb9b353b7c4
RemcosRAT
ca7a5346affad6a16ff2f1922db1b240a17c052c7fa1094934ca94fa0ab6883e
RemcosRAT
+ 1'061 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos rat upx
Link:
https://tria.ge/reports/201109-1yar6krf6a/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of SetThreadContext
UPX packed file
Remcos
Malware Config
C2 Extraction:
185.244.30.28:8780
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Remcos
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Remcos in memory
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip 25df6e933d954b1aa2274fad8c8cc1ce32f762fb3f138fc27fc9e7845e667092

RemcosRAT

Executable exe c85e13a5030bcd0c8173ef7ff6939690fe9638fa25d3c89cbf1e1e95a89db997

(this sample)

  
Dropped by
MD5 4c9f4d9785ab34123353a12eb1fa1815
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 25df6e933d954b1aa2274fad8c8cc1ce32f762fb3f138fc27fc9e7845e667092

Comments