MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d76d23b43829aa9397a40cc5df81e1c4beed7de1501931759b2c3b10a72aa80d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d76d23b43829aa9397a40cc5df81e1c4beed7de1501931759b2c3b10a72aa80d
SHA3-384 hash: 1905c24d1f82006db04de9bc35389628184334bfec8f2e5f13bc83b01bd487ba173882619c5fabf95a3e435ebc1b3c84
SHA1 hash: 32971b760c862f612128a272e68c1900eb386e4d
MD5 hash: b5a4d5072824b1ae8f3fa8815bc39370
humanhash: angel-maine-seven-purple
File name:b5a4d5072824b1ae8f3fa8815bc39370.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:2'424'832 bytes
First seen:2021-03-13 08:11:57 UTC
Last seen:2021-03-13 09:48:51 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:X+c9u1mJtBNk2E1WKiLbvdTO9Gh76E2p6yRmUoEu5X:X+c9u1mJLHEIK6n5N2pDiX
Threatray 3 similar samples on MalwareBazaar
TLSH 75B51AC5B628F1B0E38F9AFE6CFA495434C2C85DB16E51D636C8638A1851B07C2FBB15
Reporter abuse_ch
Tags:exe RAT RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
159
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
b5a4d5072824b1ae8f3fa8815bc39370.exe
Verdict:
Suspicious activity
Analysis date:
2021-03-13 08:14:16 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/36c24ebc-d2c8-4b4a-ab3a-818f58abb7c1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/124063/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Stealer.29821.6787.4860.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Unauthorized injection to a recently created process
Creating a file
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
spyw.evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/638497
Signature
Contains functionality to log keystrokes (.Net Source)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected Beds Obfuscator
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d76d23b43829aa9397a40cc5df81e1c4beed7de1501931759b2c3b10a72aa80d/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-11 16:42:16 UTC
AV detection:
24 of 47 (51.06%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=25wshnbyfgvjhf5ebtc57apbys7o27pbkamtc5m3fq5rbjzkvagq._file
Verdict:
unknown
Similar samples:
34d36c7a65242b791fb5a07af6fb5fd8732047a497eb9ae96047abbc7043c6cf
RemcosRAT
5af892f76de6b25472f9fbcabf79fa73b3f7f524bc4a50cb389aa90d9dfbf60c
RemcosRAT
73424fa69e861911199cc37a195f50a2da78c4ccc1eb1991e606ccacc6d08219
RemcosRAT
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://tria.ge/reports/210313-v8ny4bycq6/
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Beds Protector Packer
Unpacked files
SH256 hash:
97024f17003dd3d31dab64c4d1b8251e50d428644eb59ed3692ad79ce42019cf
MD5 hash:
8cd28be4bd9a1404c6d3600db32b3ed1
SHA1 hash:
fb90b0ca51118e771390d58b19d0a404ee14cfbc
Link:
https://www.unpac.me/results/8c253073-7a0d-42af-b0d4-9e41dc0f41b8/
SH256 hash:
fbab061a2e29ac5b60899a493099296e02432df7d476ec6d5e59b0e5fd44d5bd
MD5 hash:
4f9dbc79f6220f9f586673136800ee8d
SHA1 hash:
63d09a9008fbda992946ce9e2caea127623d1404
Link:
https://www.unpac.me/results/8c253073-7a0d-42af-b0d4-9e41dc0f41b8/
SH256 hash:
2304133b75bc0068f481812cf5b4db49a74e0fc7272d9dca9dc6db0cdb520cf6
MD5 hash:
ba1694adb333fc9a5d3678aced2351dc
SHA1 hash:
4fba2cf7c1f98488c0a321be5c4289ad6b81751b
Link:
https://www.unpac.me/results/8c253073-7a0d-42af-b0d4-9e41dc0f41b8/
SH256 hash:
d76d23b43829aa9397a40cc5df81e1c4beed7de1501931759b2c3b10a72aa80d
MD5 hash:
b5a4d5072824b1ae8f3fa8815bc39370
SHA1 hash:
32971b760c862f612128a272e68c1900eb386e4d
Link:
https://www.unpac.me/results/8c253073-7a0d-42af-b0d4-9e41dc0f41b8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d76d23b43829aa9397a40cc5df81e1c4beed7de1501931759b2c3b10a72aa80d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

Executable exe d76d23b43829aa9397a40cc5df81e1c4beed7de1501931759b2c3b10a72aa80d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1059804/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/124063/

Comments