MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6341a98b375200dc223f4c1d86163d8d4127f79b936c5359a859dd45cabe210. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d6341a98b375200dc223f4c1d86163d8d4127f79b936c5359a859dd45cabe210
SHA3-384 hash: 57b6d7f9fd903afc639263ff56deccd63a12b9f35971e715bd546eb550c4fa43261cf70803d971372a9c825c2fb55a76
SHA1 hash: e0ef2bd5c466164a80a405f4c9fe2893def8c05f
MD5 hash: a11d5f88df665fd3f11572d0814aeb40
humanhash: minnesota-summer-salami-georgia
File name:a11d5f88df665fd3f11572d0814aeb40.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:284'672 bytes
First seen:2020-06-02 16:31:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'602 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 6144:60srDw6lAIqemXHawYgsEDatAa2lFEfY6jvJZh8S+MqNsHm2mFf5:5sB/MyE2/2lFgY6bJZh8S+MqNsHm2mj
Threatray 777 similar samples on MalwareBazaar
TLSH 6654BDDD762032EFC827C472DEA81D78EAA1B4BA531B4613942351ED9E4C997DF240F2
Reporter abuse_ch
Tags:exe nVpn RAT RemcosRAT


Avatar
abuse_ch
RemcosRAT C2:
sack517.duckdns.org:3131 (194.5.98.13)
sack517.ddns.net:3131 (194.5.98.13)

Pointing to nVpn:

% Information related to '194.5.98.0 - 194.5.98.255'

% Abuse contact for '194.5.98.0 - 194.5.98.255' is 'abuse@inter-cloud.tech'

inetnum: 194.5.98.0 - 194.5.98.255
netname: Privacy_Online
descr: Longyearbyen, Svalbard und Jan Mayen
country: SJ
admin-c: RA9926-RIPE
tech-c: RA9926-RIPE
org: ORG-NFAS6-RIPE
status: ASSIGNED PA
mnt-by: inter-cloud-mnt
created: 2019-04-26T16:42:54Z
last-modified: 2020-03-13T23:11:55Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 00:43:46 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
28 of 48 (58.33%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2y2bvgftouqa3qrd6ta5qyld3dkbe73zxe3mknm2qwo5ixfl4iia._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
11a7d2f2722df45e01851eb75765dbcb21f70ea9c8f89f58b9e8ccacda92cc83
RemcosRAT
1d8df098798099b8106386eb335e7f793d9ce4c14c863105aa2f260cea331c44
RemcosRAT
3a90457357756473cd15940468d7af9b7862d683c3c29fa0f01e69720023bdd1
RemcosRAT
49c1e306362700be6143f3dc9592a72ca5d9dc3d7237d9f8e4f14b5c14ea2155
RemcosRAT
83413a3a3f07ee931dbfecaefed51d0b01d2b13b85920bdd485f0b2ce41acba5
RemcosRAT
a899d2b8f1cf3d0a97107dcfecafb3239cade9e8aad01fe007f3b0d8762b8b7a
RemcosRAT
c409017de52a4a6ad3a0cd3ab97ad17f9be172136155bf548bef49d7777cec1a
RemcosRAT
db28682ec511e61fa9a6425d0c7a908a99cf19b3f08c81b0e61bec26e24a15d6
RemcosRAT
e3b9a35e9155fd3c927956f03d54da02f28cc27437537d67ba302ddb4a40e57b
RemcosRAT
e9f204296b816ecf645ea8401bd531f3880634c81fb37224f39d9af058e2c08f
RemcosRAT
+ 767 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos rat
Link:
https://tria.ge/reports/201109-pxbsxrcp6x/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Uses the VBS compiler for execution
Remcos
Malware Config
C2 Extraction:
sack517.duckdns.org:3131
sack517.ddns.net:3131
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_RemcosRAT
Create hunting rule
Author:abuse.ch
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments