MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ed081d99724673a343863138b3eac0fbe402c8ba256cc466c535d3e7133187d1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 10

Intelligence 10 IOCs YARA 10 File information Comments

SHA256 hash:	ed081d99724673a343863138b3eac0fbe402c8ba256cc466c535d3e7133187d1
SHA3-384 hash:	cdb4bdc56e598160741fba9c2740e5fe9b9e76fd4e0c6906522f320d26f81eec80c2185a9e2108811f3d6d96711188b9
SHA1 hash:	faf92f0f6fc39fcf028454de68f36607677cd4cb
MD5 hash:	4f60f45f8ba53061d26c8a450dda5d9c
humanhash:	maryland-pennsylvania-magazine-pizza
File name:	DHL Invoice_pdf.scr
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	61'440 bytes
First seen:	2020-12-22 10:36:11 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	71ee61248f9a81cce45e093d8e987522 (3 x RemcosRAT)
ssdeep	768:XpnV1NbHNWx4iGmMQ+mQCv/QaTe+VHqolb6G4YTuhbKncXCtV5u9K1i:9NbtudMQ+sQa3w0b6hYTuNBytVsF
Threatray	757 similar samples on MalwareBazaar
TLSH	28531BD565A44B32F8D2CEF11D4687E862536C74FA458E42309BB79D0933FC4A9ACB0B
Reporter	abuse_ch
Tags:	DHL GuLoader nVpn RAT RemcosRAT scr

abuse_ch

Malspam distributing RemcosRAT:

HELO: vps.jocmachinerys.com
Sending IP: 45.85.90.246
From: noreply@dhl.com <office@jocmachinerys.com>
Reply-To: swiftlogz@yandex.com
Subject: Re: Top Urgent Delivery on transit
Attachment: Original Shipping Documents.rar (contains "DHL Invoice_pdf.scr")

RemcosRAT C2:
wealth.freemyip.com:39777 (185.140.53.175)

Pointing to nVpn:

% Information related to '185.140.53.0 - 185.140.53.255'

% Abuse contact for '185.140.53.0 - 185.140.53.255' is 'abuse@privacyfirst.sh'

inetnum: 185.140.53.0 - 185.140.53.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-EU
country: EU
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2016-10-17T23:24:00Z
last-modified: 2020-11-06T23:02:44Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

449

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

DHL Invoice_pdf.scr

Verdict:

Malicious activity

Analysis date:

2020-12-22 10:41:40 UTC

Tags:

rat remcos trojan keylogger

Link:

https://app.any.run/tasks/7999e6a0-922e-4da0-9f94-027c9c53f53e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Guloader

Link:

https://www.capesandbox.com/analysis/108707/

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Launching a process

Unauthorized injection to a recently created process by context flags manipulation

Result

Threat name:

Remcos GuLoader

Detection:

malicious

Classification:

rans.phis.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/568119

Signature

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Contains functionality to hide a thread from the debugger

Executable has a suspicious name (potential lure to open the executable)

Hides threads from debuggers

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

May check the online IP address of the machine

Potential malicious icon found

Sigma detected: Remcos

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file access)

Tries to steal Mail credentials (via file registry)

Writes to foreign memory regions

Yara detected GuLoader

Yara detected VB6 Downloader Generic

Behaviour

Behavior Graph:

Download SVG

Detection:

remcos

Link:

https://mwdb.cert.pl/sample/ed081d99724673a343863138b3eac0fbe402c8ba256cc466c535d3e7133187d1/

Threat name:

Win32.Trojan.VBCryptor

Status:

Malicious

First seen:

2020-12-22 10:37:05 UTC

AV detection:

8 of 28 (28.57%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=5ueb3glsizz2gq4gge4lh2wa7psafsf2evwmizwfgxj6oezrq7iq._file

Verdict:

malicious

Label(s):

guloader

RemcosRAT

1de9da3a2c6effe9e9eae16a0d70fc19c633e479073f308a666665b0628e866b

RemcosRAT

537a8ea61616d62ed663a41078e2709f21698036d90668961ba6ebd16db08b86

RemcosRAT

63db179f245a255319a3e4e4b4463e35803e651fa2041f329076d60033c6d51c

RemcosRAT

a95255b520f721b807650a1de5feeefab46054029386cd0ce57c81daa3ac0248

RemcosRAT

d4d22a42f8307b64ffeeaa26275000213a940c1792231db0911678d7bbb2cfb9

RemcosRAT

e05f05fb070ab182f3f8daadedde9b58ba9ab1c9bf0dd66bd2e8a5a9ac63f479

RemcosRAT

e45b4d0e0b338b2a3875466e875b008043acf8240da0d6caa2ec14d13c02fe41

RemcosRAT

e74ff01d6412f87caf49182bdf1cae9e6d7200a3c176e37b7ff14b158f1a7433

RemcosRAT

e8f0dd4a951cb42729e34171301bf46bd708a8c1c1c0b5b7daf2ed9036b97cca

RemcosRAT

+ 747 additional samples on MalwareBazaar

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos rat

Link:

https://tria.ge/reports/201222-aeb1hvppqj/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Legitimate hosting services abused for malware hosting/C2

Remcos

Unpacked files

SH256 hash:

ed081d99724673a343863138b3eac0fbe402c8ba256cc466c535d3e7133187d1

MD5 hash:

4f60f45f8ba53061d26c8a450dda5d9c

SHA1 hash:

faf92f0f6fc39fcf028454de68f36607677cd4cb

Link:

https://www.unpac.me/results/56270794-b3ed-435f-a052-0da3a9fc9e87/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/ed081d99724673a343863138b3eac0fbe402c8ba256cc466c535d3e7133187d1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_RemcosRAT Create hunting rule
Author:	abuse.ch

Rule name:	Chrome_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Chrome in files like avemaria

Rule name:	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer Create hunting rule
Author:	ditekSHen
Description:	detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Rule name:	Keylog_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Contains Keylog

Rule name:	Parallax Create hunting rule
Author:	@bartblaze
Description:	Identifies Parallax RAT.

Rule name:	Remcos Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Remcos in memory

Rule name:	remcos_rat Create hunting rule
Author:	jeFF0Falltrades

Rule name:	REMCOS_RAT_variants Create hunting rule

Rule name:	suspicious_packer_section Create hunting rule
Author:	@j0sm1
Description:	The packer/protector section names/keywords
Reference:	http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator