MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d022c7c07d36d1de56a35bc0f45389046a07e2ff013f3330e70d6158215be1d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d022c7c07d36d1de56a35bc0f45389046a07e2ff013f3330e70d6158215be1d2
SHA3-384 hash: 0d32aa1d87fd39bda8c0743481ac012887fad26ecf3aa29925566c0ed419c58d81af121af9e4371a03fd73ee34444f59
SHA1 hash: e4947404510e5fb4906d195ddd1e2d9359228c68
MD5 hash: b9114f4d2878706649efc04c6ddf8b30
humanhash: pluto-fillet-fourteen-nevada
File name:b9114f4d2878706649efc04c6ddf8b30.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:613'544 bytes
First seen:2020-07-13 11:45:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ea689d2787403906ea0d5ca42ec2405c (1 x RemcosRAT)
ssdeep 12288:wf7pYDVdwl77TfozD+mIIGwc0QufpmemXmogxTsw7zj:wfNADwl7/i+mEwcVgzmWoez
Threatray 312 similar samples on MalwareBazaar
TLSH DCD47D22B6F14437F06235389D4B93A86939BEDB3E249C466BE82E4C4F356503B391D7
Reporter abuse_ch
Tags:exe nVpn RAT RemcosRAT


Avatar
abuse_ch
RemcosRAT C2:
karimgoussd.ug:6968 (79.134.225.49)

Pointing to nVpn:

% Information related to '79.134.225.0 - 79.134.225.63'

% Abuse contact for '79.134.225.0 - 79.134.225.63' is 'abuse@anmaxx.net'

inetnum: 79.134.225.0 - 79.134.225.63
netname: BASEL-HOSTING-225-0
country: CH
admin-c: AM38880-RIPE
tech-c: AM38880-RIPE
status: ASSIGNED PA
mnt-by: AF15-MNT
created: 2016-04-17T00:42:52Z
last-modified: 2016-04-18T06:23:19Z
source: RIPE
remarks: abuse-c AIS166-RIPE
org: ORG-AGIS12-RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/25269/
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
DNS request
Sending a custom TCP request
Launching the default Windows debugger (dwwin.exe)
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d022c7c07d36d1de56a35bc0f45389046a07e2ff013f3330e70d6158215be1d2/
Threat name:
Win32.Trojan.RemcosCrypt
Create hunting rule
Status:
Malicious
First seen:
2020-07-11 13:16:26 UTC
AV detection:
30 of 48 (62.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2armpqd5g3i54vvdlpapiu4jarvapyx7ae7tgmhhbvqvqik34hja._file
Verdict:
suspicious
Similar samples:
06fbbbc992085d6851383435dd9f114b5c58e936d392f7ccd3861a27f8eaa04b
RemcosRAT
45bd070ecdb312c1f7b26ffefc4c122b4f3d373b75bf7dd2628a37407b29cad6
RemcosRAT
47ac20ddd5ae0c3421fdef69a252159644b6f764638c9b2bfa0dadd17065e976
RemcosRAT
491cff43b259addd44a312094b15674d2c33c9ab901500130fead03e7d9d6530
RemcosRAT
90d5792fd0a2ab859f120bef8f12a28c8f7e4119a43054c22db57e76c7b386a0
RemcosRAT
95305595e6858d0f37de53a6fcde486fca7b4d44a7742d6f6387fb1677d78745
RemcosRAT
b201c180da5e6cb1d70ae9e5a67bba023192f0024c69498876a960c58ed01ffd
RemcosRAT
caadaf420eed8a87831e8e3c02a6720272a4de3e3eb08e0a3f35a16837a17383
RemcosRAT
e6ae69a007404e1d3dc15350940a8f92750c3af9e4accb76be1cae8aea98804a
RemcosRAT
f37f40245387cf924b4692267251875273ef75ad03fa9f92d73ab021f5c9e307
RemcosRAT
+ 302 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://tria.ge/reports/200713-2d77eh58qe/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Program crash
Program crash
Legitimate hosting services abused for malware hosting/C2
Legitimate hosting services abused for malware hosting/C2
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

Executable exe d022c7c07d36d1de56a35bc0f45389046a07e2ff013f3330e70d6158215be1d2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/410340/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/410774/
Cape
Cape
https://www.capesandbox.com/analysis/25269/

Comments