MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f57374520bfbf5f5afbbfe8c8cf762f95e05cf050fe959d731d49b77f4776cba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f57374520bfbf5f5afbbfe8c8cf762f95e05cf050fe959d731d49b77f4776cba
SHA3-384 hash: 6c22106588b3cab2853b42f201c31495bbbda7715e56f584ccc53cf79865ceff9410711bc4ed4d23f1c524f28b77b035
SHA1 hash: 8eba21d7cc6e8aa2a447b3068d52c0a05be1a581
MD5 hash: c886e0ee430adb7f805df32d86d80d71
humanhash: friend-massachusetts-wolfram-helium
File name:REQUEST FOR QUOTE REF -TAI2020504.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:456'192 bytes
First seen:2020-05-04 20:50:03 UTC
Last seen:2020-05-04 21:51:44 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'473 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 6144:ajfdB7s7CJ0uXZ+zxmcYtx0hesQ8HuGupxrFKitz:ajdBg2J0s+xmfPkC8O9Kitz
Threatray 1'186 similar samples on MalwareBazaar
TLSH 71A44A56B9A0D661CBD848B1FD07E2620B249C9F5D0262936BF4BE373FED613DA01136
Reporter abuse_ch
Tags:exe RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: cpb2.medionline.cl
Sending IP: 45.55.49.33
From: Mrs. Lai Wu Mei Chu <info@thaibev.com>
Subject: REQUEST FOR QUOTE - REF: TAI2020504
Attachment: REQUEST FOR QUOTE REF -TAI2020504.rar (contains "REQUEST FOR QUOTE REF -TAI2020504.exe")

RemcosRAT C2:
212.83.46.23:3110

Intelligence

File Origin
# of uploads :
2
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.48323.17772.14253.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 15:35:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
47
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6vzxiuql7p27ll5372giz53c7fpaltyfb7uvtvzr2snxp5dxns5a._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
0598b4ce2460676755245bad49490a9c94ae85a074c2242adfa65c52b0ad3796
RemcosRAT
20edc5b15578c2714fd64a6577a5bd1fbbb13434dc2e900e3b7c568537206050
RemcosRAT
82d3edc9ad7ba25feca5ef08641b0f030d92faa5dec17f3148e062b727a0240c
RemcosRAT
895225b53f54d122a60d52a692acfe09a4fb64fbc2bea01746d2ec3f12e3a564
RemcosRAT
a563a898ce1c8dcac374ef8a468e39a185ca3b010f1a41b60731a7beac23f846
RemcosRAT
b590b1181625df5cc62b8716449c07faf158411381babca4d22988c5d852aafa
RemcosRAT
d3ccfc7eefe685bc703f2975cde7560c851f7e28f8fac127baf54b24ede4ca91
RemcosRAT
e20afb0d09a4e47be30404425e599d42071b310c01f0d9674567a4f3e284b62c
RemcosRAT
e2d6119bb484c9e5f5a7107b4687553416208badbb881df4328bec5146d08509
RemcosRAT
f3eb876bdd52d2f6fb8a8dfe28fcff50129a1fd88f76b3e99c500357c36ff862
RemcosRAT
+ 1'176 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos rat
Link:
https://tria.ge/reports/201109-sgpexdvkk2/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Remcos
Malware Config
C2 Extraction:
212.83.46.23:3110
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Remcos
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Remcos in memory
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar 21e452ec2d61328abd03e03d68781d80b79a08ca6a7dea23d58a9906b172663b

RemcosRAT

Executable exe f57374520bfbf5f5afbbfe8c8cf762f95e05cf050fe959d731d49b77f4776cba

(this sample)

  
Dropped by
MD5 51a44feb3efd130871e0995cece1ff13
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 21e452ec2d61328abd03e03d68781d80b79a08ca6a7dea23d58a9906b172663b

Comments