MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ec639f932f7e3c075d735973cd493fe7a895bf660b4aff4fc4c97af08baf64b8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ec639f932f7e3c075d735973cd493fe7a895bf660b4aff4fc4c97af08baf64b8
SHA3-384 hash: 898822b38260338ed584eb0aaa60e048dd4dc176456ab0403545877837f7f4ec9fdc3988f05589009b56306f0cae193b
SHA1 hash: a7ffe9defc27682fde6fabe448fdeafbf96f5e69
MD5 hash: fc06eec712d2869c2d7b51a6e36f1995
humanhash: utah-hamper-beryllium-magazine
File name:nkbin01h.h3d.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:290'816 bytes
First seen:2020-05-10 07:54:32 UTC
Last seen:2020-05-10 08:45:50 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:54TJYSl9hCffqJx73vIDZJ0UrN6d+TQu9TBpUvrG8Qz:5CYSZICX/w5S60Y
Threatray 26 similar samples on MalwareBazaar
TLSH 1D54E027BE181A32CDCE0BFB15761618CB3D87D99B00E7584DD128CA69D73389690B7E
Reporter abuse_ch
Tags:exe nVpn RAT RemcosRAT RemocsRAT


Avatar
abuse_ch
RemcosRAT payload URL:
http://77.73.69.137/edsd/nkbin01h.h3d.exe

RemcosRAT C2:
imagine999.ddns.net:7082 (185.140.53.18)

Pointing to nVpn:

% Information related to '185.140.53.0 - 185.140.53.255'

% Abuse contact for '185.140.53.0 - 185.140.53.255' is 'abuse@FOS-VPN.org'

inetnum: 185.140.53.0 - 185.140.53.255
netname: Freedom_Of_Speech_VPN
remarks: Before you contact us, please read:
remarks: 185.140.53.0/24 belongs to a NON-LOGGING VPN service.
remarks: We don't log any user activities.
remarks: We believe that the right to informational self-determination and the
remarks: right to privacy are essential to all citizens of all countries.
remarks: We don't host anything else on our servers than VPN software and our
remarks: customers can open a fixed number of Ports.
remarks: Like Public WiFi or Tor Exit Node Operators we cannot be held responsible
remarks: for the actions of our customers, because we simply can't (and to be
remarks: honest: don't want) to control them.
country: EU
org: ORG-SL751-RIPE
admin-c: SL12644-RIPE
tech-c: SL12644-RIPE
status: ASSIGNED PA
mnt-by: FOS-VPN-MNT
created: 2016-10-17T23:24:00Z
last-modified: 2020-04-06T18:59:49Z
source: RIPE

Intelligence

File Origin
# of uploads :
2
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Ursu.866529.28442.6089.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-10 09:11:46 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
25 of 31 (80.65%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5rrz7ezppy6aoxltlfz42sj746ujlp3gbnfp6t6ezf5pbc5pms4a._file
Verdict:
unknown
Similar samples:
0edd45b70fa551b13b37faf2146011fbdb3299e69f20bedb7e48c1710d3a0159
RemcosRAT
442452b82edb2b18431c296669c78df1c88b210775e9a9b5d7726a1092a8fc6f
RemcosRAT
6575a80b5fa70f2b72b0c5270e4bf316efbdda166b73267a783ebe8a56f3cd1e
RemcosRAT
6ff25388a91cbed0a11467e592e39e34c54de49d61876a2a201554e67c5b8cb4
RemcosRAT
8224d188f60fa7c7b60249b82cd7d94336542a8a21a57c9adcb00530e068f818
RemcosRAT
cbb6d89187847aab1fcff6b5d832ea80bca30bfe5520702133cab83335392ead
RemcosRAT
d73498e0aabb97375783af491aded66aa6710ba848247de3337f404fa02a35c0
RemcosRAT
e43ee2ab62f9dbeb6c3c43c91778308b450f5192c0abb0242bfddb8a65ab883a
RemcosRAT
fdafb44be84ea918c76a99f4c24c08fbe8de6648a4ad73614f77450aa2b43484
RemcosRAT
ff5a506b69008ad7cc902dd5ca6b0fe6c2235e532b9b2421bf4b86dd2b13462b
RemcosRAT
+ 16 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos persistence rat
Link:
https://tria.ge/reports/201109-1wdw6cb81a/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Remcos
Malware Config
C2 Extraction:
imagine999.ddns.net:7082
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_RemcosRAT
Create hunting rule
Author:abuse.ch
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_remcos_g0
Create hunting rule
Author:Daniel Plohmann <daniel.plohmann<at>fkie.fraunhofer.de>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Word file docm 6d3f1c09d745c6e3a1b7dd9f48e8f8805d395b81c6694784b16ae7edff8dba42

RemcosRAT

Executable exe ec639f932f7e3c075d735973cd493fe7a895bf660b4aff4fc4c97af08baf64b8

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/360714/
  
Dropped by
SHA256 6d3f1c09d745c6e3a1b7dd9f48e8f8805d395b81c6694784b16ae7edff8dba42
  
Delivery method
Distributed via web download

Comments