MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c93cb82d0cf5c20e8efb54197b95e646dc6a47168908bd024969892c0ec2a0b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c93cb82d0cf5c20e8efb54197b95e646dc6a47168908bd024969892c0ec2a0b6
SHA3-384 hash: 0274e3a48402e0f106b5b5f830a18f255504cc67e940683e10bfe22690195bdc1b78e4717ecb2e090f9868b38b3ef445
SHA1 hash: bca085a00931ad0d66949fa573ce3e56c7a73a0f
MD5 hash: 27bba93ed7b6d371e5ccb4a79519bcdf
humanhash: golf-lamp-tango-hotel
File name:27bba93ed7b6d371e5ccb4a79519bcdf
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:903'425 bytes
First seen:2021-06-22 06:52:11 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:4bguj45Rg4xLQBbNWVjsq/SlaqRh6LEpD4n7CEC5ZTJn:4bZs53LQBR04uSzRhHJg7DC5dJn
TLSH C315336CCF9CCAFCEDF104A994B2D4115528A78056C63077DBA075918327F37ACDDAA2
Reporter zbetcheckin
Tags:RAT zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
108
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs410.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/c93cb82d0cf5c20e8efb54197b95e646dc6a47168908bd024969892c0ec2a0b6
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c93cb82d0cf5c20e8efb54197b95e646dc6a47168908bd024969892c0ec2a0b6/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-06-22 06:53:09 UTC
AV detection:
20 of 46 (43.48%)
Threat level:
  5/5
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:newnew rat
Link:
https://tria.ge/reports/210622-2s3tdwmc3a/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Executes dropped EXE
Remcos
Malware Config
C2 Extraction:
103.147.184.53:4041
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c93cb82d0cf5c20e8efb54197b95e646dc6a47168908bd024969892c0ec2a0b6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

zip c93cb82d0cf5c20e8efb54197b95e646dc6a47168908bd024969892c0ec2a0b6

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1387522/

Comments