MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ea20483460e7b93a3ed6fa7464ddaa7453be836c6b8bd6c0aa39ecd512fbac28. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 7


Intelligence 7 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ea20483460e7b93a3ed6fa7464ddaa7453be836c6b8bd6c0aa39ecd512fbac28
SHA3-384 hash: b2b8a7216fec62d14d255da618dbbf7d3d6db4f3aebcdad6a115a27a4efff44e89d9706fbbeb8ccae5fb68d46f94820a
SHA1 hash: ba952e2c673723e2a5741aa2eace02ee2492ae44
MD5 hash: 15c0a035e6b087ab28dcf9c1ae9bfe9a
humanhash: potato-alabama-white-sink
File name:AWB238668464747737.doc.r00
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:789'705 bytes
First seen:2024-02-07 08:39:15 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 24576:RPr48phCyoRC9H9J77qqMen87KxAKlSy5z:RPNkI9j33KXXy5z
TLSH T14DF4338DB9BE2E757355B8603C361FA77CC7420A272AE659CC1A4BD1BC8A134D135E0B
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:DHL r00 RemcosRAT


Avatar
cocaman
Malicious email (T1566.001)
From: "DHL Global Forwarding <asif.ali.ahmed@dhl.com>" (likely spoofed)
Received: "from [194.33.191.107] (unknown [194.33.191.107]) "
Date: "7 Feb 2024 10:22:56 -0800"
Subject: "SHIPMENT NOTIFICATION BY DHL"
Attachment: "AWB238668464747737.doc.r00"

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:AWB238668464747737.doc.exe
File size:856'097 bytes
SHA256 hash: c09a27a46df5d4e4320beea5f2538a5a43b6d6a5eb62a9b10bdc4a182f0eb0af
MD5 hash: 1abc83b6b8ab32fb1710c425a5279a0a
MIME type:application/x-dosexec
Signature RemcosRAT
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27215.RarHeur.nocdb.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
autoit fingerprint keylogger lolbin masquerade overlay packed packed packed remcos shell32 upx
Link:
https://www.filescan.io/uploads/65c341ed2cb3f19023f3a28d/reports/37b376f0-887e-4b62-892f-eaadda8c8d26/overview
Verdict:
Suspicious
Labled as:
Mal/DrodRar
Link:
https://www.hybrid-analysis.com/sample/ea20483460e7b93a3ed6fa7464ddaa7453be836c6b8bd6c0aa39ecd512fbac28
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ea20483460e7b93a3ed6fa7464ddaa7453be836c6b8bd6c0aa39ecd512fbac28/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2024-02-07 08:39:18 UTC
File Type:
Binary (Archive)
Extracted files:
25
AV detection:
16 of 38 (42.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5iqeqnda464tupww7j2gjxnkorj35a3mnof5nqfkhhwnkex3vqua._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.84
Link:
https://yomi.yoroi.company/submissions/ea20483460e7b93a3ed6fa7464ddaa7453be836c6b8bd6c0aa39ecd512fbac28

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIt
Create hunting rule
Author:Jean-Philippe Teissier / @Jipe_
Description:AutoIT packer
Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MAL_Malware_Imphash_Mar23_1
Create hunting rule
Author:Arnim Rupp
Description:Detects malware by known bad imphash or rich_pe_header_hash
Reference:https://yaraify.abuse.ch/statistics/
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:UPXv20MarkusLaszloReiser
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

r00 ea20483460e7b93a3ed6fa7464ddaa7453be836c6b8bd6c0aa39ecd512fbac28

(this sample)

RemcosRAT

Executable exe c09a27a46df5d4e4320beea5f2538a5a43b6d6a5eb62a9b10bdc4a182f0eb0af

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c09a27a46df5d4e4320beea5f2538a5a43b6d6a5eb62a9b10bdc4a182f0eb0af
  
Dropping
MD5 1abc83b6b8ab32fb1710c425a5279a0a

Comments