MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 e16fca2ddc966a1a20b47df8c007cc64cda7f3a9f74f6f04a38d93f13324a379. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RemcosRAT
Vendor detections: 13
| SHA256 hash: | e16fca2ddc966a1a20b47df8c007cc64cda7f3a9f74f6f04a38d93f13324a379 |
|---|---|
| SHA3-384 hash: | 270de58f798ae22a662198808e43de37ea8779f9bda9c7232aa899c40b9cd35043a6abc48610c0a63376e1a381ecc5b3 |
| SHA1 hash: | 58c1176c2559992e112cea8fbcb489bbc79bf0f0 |
| MD5 hash: | 083e0046bf1fa3e6f309af8301ced7f9 |
| humanhash: | georgia-low-twenty-maine |
| File name: | c33c6718a4f5fd56ca8aff099c4d1681.exe |
| Download: | download sample |
| Signature | RemcosRAT |
| File size: | 491'520 bytes |
| First seen: | 2021-02-10 08:12:35 UTC |
| Last seen: | 2021-02-10 10:15:46 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger) |
| ssdeep | 6144:Vr+ETteKXLDpA6MdwV8j2h7ZXl53Jd3mrqpVNsbahnCoYiS9lTZRgsMuj6g6Isrw:VaEtXLDJnl5FpfsuCP99wsRj6lM |
| Threatray | 1'538 similar samples on MalwareBazaar |
| TLSH | F1A4CF03A9585B97E02943FC7D130DA41FBA770DE893FAEE09521ECF29217164D8A52F |
| Reporter |  abuse_ch |
| Tags: | exe RAT RemcosRAT |
Intelligence
File Origin
# of uploads :
2
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
c33c6718a4f5fd56ca8aff099c4d1681.exe
Verdict:
Malicious activity
Analysis date:
2021-02-10 08:13:54 UTC
Tags:
rat remcos keylogger
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a custom TCP request
Sending a UDP request
Creating a file in the %AppData% subdirectories
Creating a file in the %temp% directory
Creating a file
Creating a process from a recently created file
Creating a process with a hidden window
Deleting a recently created file
Running batch commands
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Detection:
remcos
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2021-02-10 08:13:05 UTC
File Type:
PE (.Net Exe)
Extracted files:
37
AV detection:
23 of 28 (82.14%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
remcos
Similar samples:
+ 1'528 additional samples on MalwareBazaar
Result
Malware family:
remcos
Score:
10/10
Tags:
family:remcos persistence ransomware rat
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Remcos
Malware Config
C2 Extraction:
sandshoe.myfirewall.org:2404
Unpacked files
SH256 hash:
b212f0dfc69f00068a581f076e1f81315ed932cddaa6fd0c67c64cf722c46723
MD5 hash:
137275f8cfdad6f05e8f1a7b2edc5033
SHA1 hash:
6becfb294a315cec2976081ba3773996b8010871
Detections:
win_remcos_g0
win_remcos_auto
Parent samples :
2ac63fd303f0da81cfc80c17bf1cb6e9ef3d11abf648449271e980a91646ca25
abd5600b6b5f6228c095e5703429fbcecc647611fadd3e49090fbb70a8cfb728
c4f18a18795f014313de0e26a1545c184da0223f0e40e481306b69e570471733
48e8ff87262aacbe6b64962d5703ddf042e51bd5cd099bc787923ab33f172ccb
e16fca2ddc966a1a20b47df8c007cc64cda7f3a9f74f6f04a38d93f13324a379
ac03de9eb86c038c61523da3b2e8e8d6748f6f45762e44564547f96df37acbe4
abd5600b6b5f6228c095e5703429fbcecc647611fadd3e49090fbb70a8cfb728
c4f18a18795f014313de0e26a1545c184da0223f0e40e481306b69e570471733
48e8ff87262aacbe6b64962d5703ddf042e51bd5cd099bc787923ab33f172ccb
e16fca2ddc966a1a20b47df8c007cc64cda7f3a9f74f6f04a38d93f13324a379
ac03de9eb86c038c61523da3b2e8e8d6748f6f45762e44564547f96df37acbe4
SH256 hash:
bc3accecf8db9f4034efd94c31337027216b5331ddd38ae4243d0d393da73532
MD5 hash:
ddf488ec9ff59509139dda7adc5952b8
SHA1 hash:
fa216a55dd910c5959e25bfa7afbddceecfafae0
SH256 hash:
2ec41720b412f91f91daaefea38007449491b2c016238aa8f23b6866c89bc788
MD5 hash:
987ce346069cf47535e5ac57265c7228
SHA1 hash:
d0085325ed78fcac6d1f605753237abd1c40db22
SH256 hash:
e16fca2ddc966a1a20b47df8c007cc64cda7f3a9f74f6f04a38d93f13324a379
MD5 hash:
083e0046bf1fa3e6f309af8301ced7f9
SHA1 hash:
58c1176c2559992e112cea8fbcb489bbc79bf0f0
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | ach_RemcosRAT |
|---|---|
| Author: | abuse.ch |
| Rule name: | Chrome_stealer_bin_mem |
|---|---|
| Author: | James_inthe_box |
| Description: | Chrome in files like avemaria |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer |
|---|---|
| Author: | ditekSHen |
| Description: | detects Windows exceutables potentially bypassing UAC using eventvwr.exe |
| Rule name: | Keylog_bin_mem |
|---|---|
| Author: | James_inthe_box |
| Description: | Contains Keylog |
| Rule name: | Parallax |
|---|---|
| Author: | @bartblaze |
| Description: | Identifies Parallax RAT. |
| Rule name: | Remcos |
|---|---|
| Author: | JPCERT/CC Incident Response Group |
| Description: | detect Remcos in memory |
| Rule name: | remcos_rat |
|---|---|
| Author: | jeFF0Falltrades |
| Rule name: | REMCOS_RAT_variants |
|---|
| Rule name: | SUSP_Modified_SystemExeFileName_in_File |
|---|---|
| Author: | Florian Roth |
| Description: | Detecst a variant of a system file name often used by attackers to cloak their activity |
| Reference: | https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group |
| Rule name: | win_remcos_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | autogenerated rule brought to you by yara-signator |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.