MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e85de613abef99e65212dcd6f8077b03763fa37fa81e7921907c9e9c3859b632. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 8


Intelligence 8 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e85de613abef99e65212dcd6f8077b03763fa37fa81e7921907c9e9c3859b632
SHA3-384 hash: 949123eafd164b0994558a44aa7946653c1fce4c7592206c0c0d1d536f3f5b7e645e57b5772db7723e63cd046067a7b1
SHA1 hash: 1a25c2d60553096a67b3c87c6385d3e831e84647
MD5 hash: 5dd2c165636eff7f866e18370351101e
humanhash: lithium-sodium-lithium-asparagus
File name:Covid-19 relief.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:560'640 bytes
First seen:2020-11-18 12:32:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'597 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 6144:oL+0RTQHdWvvurs1UGKuOYmk3auPnfyuSkwzAT0Yne6cjnuQwG2U9bZ8BjAPuE5x:b0x4YvWgqe1fSDzY3e6caBGV9b3PuIT
Threatray 1'487 similar samples on MalwareBazaar
TLSH 65C4DF02ABB6DE7BC7F436FB105170490E5D9E909CB1BA81BA5CB059FEB3F02D490196
Reporter abuse_ch
Tags:COVID-19 exe RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: englam.com.sg
Sending IP: 103.11.189.57
From: IRS <noreply@taxpayers.com>
Subject: Coronavirus Tax Relief and Economic Impact Payments
Attachment: Covid-19 relief.img (contains "Covid-19 relief.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
141
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.461.27340.10996.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% directory
Launching a process
Creating a file
DNS request
Sending a custom TCP request
Creating a file in the %AppData% subdirectories
Forced shutdown of a system process
Setting a global event handler for the keyboard
Unauthorized injection to a system process
Result
Gathering data
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/541145
Signature
Contains functionality to capture and log keystrokes
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Detected Remcos RAT
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 319675 Sample: Covid-19 relief.exe Startdate: 18/11/2020 Architecture: WINDOWS Score: 100 32 Malicious sample detected (through community Yara rule) 2->32 34 Multi AV Scanner detection for dropped file 2->34 36 Multi AV Scanner detection for submitted file 2->36 38 6 other signatures 2->38 7 Covid-19 relief.exe 3 2->7         started        process3 file4 22 C:\Users\user\AppData\Roaming\Covid-19, PE32 7->22 dropped 24 C:\Users\user\...\Covid-19:Zone.Identifier, ASCII 7->24 dropped 40 Writes to foreign memory regions 7->40 42 Maps a DLL or memory area into another process 7->42 44 Hides that the sample has been downloaded from the Internet (zone.identifier) 7->44 11 RegAsm.exe 2 3 7->11         started        16 Covid-19 relief.exe 7->16         started        signatures5 process6 dnsIp7 28 chaseric.ddns.net 194.5.97.21, 24002, 49748, 49750 DANILENKODE Netherlands 11->28 30 chaseric.hopto.org 11->30 26 C:\Users\user\AppData\Roaming\...\logs.dat, ASCII 11->26 dropped 46 Contains functionality to steal Chrome passwords or cookies 11->46 48 Contains functionality to capture and log keystrokes 11->48 50 Contains functionality to inject code into remote processes 11->50 52 Contains functionality to steal Firefox passwords or cookies 11->52 54 Writes to foreign memory regions 16->54 56 Maps a DLL or memory area into another process 16->56 18 RegAsm.exe 16->18         started        20 RegAsm.exe 16->20         started        file8 signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e85de613abef99e65212dcd6f8077b03763fa37fa81e7921907c9e9c3859b632/
Threat name:
ByteCode-MSIL.Ransomware.TeslaCrypt
Create hunting rule
Status:
Malicious
First seen:
2020-11-18 12:33:05 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5bo6me5l56m6muqs3tlpqb33an3d7i37vaphsimqpspjyoczwyza._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
11b16ba733f2f4f10ac58021eecaf5668551a73e2a1acfae99745c50bfccbb44
RemcosRAT
1dc145b173ba2184fdf10d99048af85b721f017c5fa523777bd8661c64bf3405
RemcosRAT
21b63e2e1226fdacd86d2662b14d9e750d98655a06504e151be154391670c859
RemcosRAT
344e6fbb3b331ae13507bca32206ceea89837dc6c02eeadeeee979d8312199b6
RemcosRAT
346c5380b5669b73b9fc43a1a17c31ea17985488e9ea947d93a1c6858ebab5e1
RemcosRAT
485c1301f4bc84bc2d274f53222cf7ca5fbd8af8728d1aaa977a6574f577fb87
RemcosRAT
628714308e23fcb40095b63c6822b08f8a9b90de2ac290ff1e8e01b6ccde1568
RemcosRAT
a66b740c103035f94d2d78140ead520be0e9ee0c218ab7dc17ebb3cfa2ea4f86
RemcosRAT
c032e316eefbacca4b3ddfe7fc2ee9ac5f86daea767232d2322f7fdfe4b18993
RemcosRAT
e86d9b9cdf1f341e2c2f811a31d371204d181385f6c32282057b976d25f53591
RemcosRAT
+ 1'477 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos rat
Link:
https://tria.ge/reports/201118-mvdk7e2gs2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Remcos
Malware Config
C2 Extraction:
chaseric.hopto.org:24002
chaseric.ddns.net:24002
Unpacked files
SH256 hash:
e85de613abef99e65212dcd6f8077b03763fa37fa81e7921907c9e9c3859b632
MD5 hash:
5dd2c165636eff7f866e18370351101e
SHA1 hash:
1a25c2d60553096a67b3c87c6385d3e831e84647
Link:
https://www.unpac.me/results/862ca232-8bcd-452f-9996-eff2c643f40c/
SH256 hash:
2cbe109c3584ee22a3028211dcd7eec13e07589b6b104fb8a52b082ea16dd29d
MD5 hash:
7edfbd8944eb18102750905e2cbf63d0
SHA1 hash:
7a816da1a37043662bfdd512db7464bd9ac64fe7
Link:
https://www.unpac.me/results/862ca232-8bcd-452f-9996-eff2c643f40c/
SH256 hash:
e0e2abdc261668465de09e920e455843b2a0a75b3b711a5e95f5f399ebb10b09
MD5 hash:
bd044664363bcf0a3f77130fb6206da1
SHA1 hash:
23aacfc04443c986ee60cd381ad9231d7e51026b
Detections:
win_remcos_g0
Create hunting rule
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/862ca232-8bcd-452f-9996-eff2c643f40c/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_RemcosRAT
Create hunting rule
Author:abuse.ch
Rule name:Chrome_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Chrome in files like avemaria
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:Parallax
Create hunting rule
Author:@bartblaze
Description:Identifies Parallax RAT.
Rule name:Remcos
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Remcos in memory
Rule name:remcos_rat
Create hunting rule
Author:jeFF0Falltrades
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

img b91adc2dddfecd60dc568791a46aa03ad6081216027acacc40b42a978e07a764

RemcosRAT

Executable exe e85de613abef99e65212dcd6f8077b03763fa37fa81e7921907c9e9c3859b632

(this sample)

  
Dropped by
MD5 8ac5cf708d95c7759426aebd70347e3e
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 b91adc2dddfecd60dc568791a46aa03ad6081216027acacc40b42a978e07a764

Comments