MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 e98459447d40bb2a0917db99a3b9a99f22ee66234bfece9bba40f4fea3851201. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RemcosRAT
Vendor detections: 8
| SHA256 hash: | e98459447d40bb2a0917db99a3b9a99f22ee66234bfece9bba40f4fea3851201 |
|---|---|
| SHA3-384 hash: | 0cccfbf9ee90d797578b82e1effe1744e7cefd40fb2cf6a5b3ab91dbf62294a263d8b5e83fa3dd126ac5b35f436385b9 |
| SHA1 hash: | 7e8fe85d19821bcfebae3cd3a083481b1fdd687c |
| MD5 hash: | dff186097bdb9bbd26ba111344e08f89 |
| humanhash: | tennis-kentucky-jersey-sierra |
| File name: | P1001094.EXE |
| Download: | download sample |
| Signature | RemcosRAT |
| File size: | 1'214'144 bytes |
| First seen: | 2020-11-28 09:26:30 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 23de31c260a4b45c8d1ef99329fb5969 (2 x RemcosRAT, 1 x ModiLoader, 1 x AveMariaRAT) |
| ssdeep | 24576:DLHLdu/OaH5JS1H6OkN5HYybBl8gKmX9hIbEIKF:DLrd08kN5HYY0gKAh |
| Threatray | 1'491 similar samples on MalwareBazaar |
| TLSH | 8B45CF23B1B28436C12275BD9E1B41ED6EB5FD717878750E37E0A90CCF3AA9179250A3 |
| Reporter |  abuse_ch |
| Tags: | exe RemcosRAT |
abuse_ch
Malspam distributing unidentified malware:HELO: slot0.deinflae.com
Sending IP: 45.85.90.138
From: overseassales@hotmail.com.cn
Subject: P100109049 new order of MNRR270 16800pcs
Attachment: P100109441 soundbars TH-S320B 1200qty, TH-S430B 1134qty, TH-S560B 1000qty - vendor confirm draft Nov (contains "P1001094.EXE")
Intelligence
File Origin
# of uploads :
1
# of downloads :
189
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Sending a UDP request
Creating a window
DNS request
Sending a custom TCP request
Creating a file
Launching a process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Connection attempt to an infection source
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
72 / 100
Signature
Allocates memory in foreign processes
Creates a thread in another existing process (thread injection)
Injects a PE file into a foreign processes
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Behaviour
Behavior Graph:
Threat name:
Win32.Backdoor.NetWiredRc
Status:
Malicious
First seen:
2020-11-26 22:21:31 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
remcos
Similar samples:
+ 1'481 additional samples on MalwareBazaar
Result
Malware family:
remcos
Score:
10/10
Tags:
family:modiloader family:remcos persistence rat trojan
Behaviour
Script User-Agent
Suspicious use of WriteProcessMemory
Adds Run key to start application
ServiceHost packer
ModiLoader, DBatLoader
Remcos
Unpacked files
SH256 hash:
e98459447d40bb2a0917db99a3b9a99f22ee66234bfece9bba40f4fea3851201
MD5 hash:
dff186097bdb9bbd26ba111344e08f89
SHA1 hash:
7e8fe85d19821bcfebae3cd3a083481b1fdd687c
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.