MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f8db8d7d0f7ba777f5f18452579f40a224a055c6624066b5dce501121cc91c5c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 11


Intelligence 11 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f8db8d7d0f7ba777f5f18452579f40a224a055c6624066b5dce501121cc91c5c
SHA3-384 hash: 9f3c5fe070152789c98b1a0fd637aae1ee5b8298304dedd544680043705b4b66a1b84185522f3d64f994fbd82da8470b
SHA1 hash: 507dd231828f1ad1dc122696d606bba83fd04d73
MD5 hash: c1d716ce56ac5afbf43c83ac04b07aa5
humanhash: lemon-wisconsin-undress-salami
File name:TH5409236BBG.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:516'608 bytes
First seen:2020-10-12 09:13:03 UTC
Last seen:2020-10-12 23:36:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:s5e2IX+vhzP/1ILN5pmfHbiXOonpF6o20xiRee:sDW+vhzP3G+opUo/xMf
Threatray 808 similar samples on MalwareBazaar
TLSH 90B4F136379CEF26D5BDA7BD0538000857F1B1A2EB21D71B7D98809D1AAAF81C762743
Reporter GovCERT_CH
Tags:RemcosRAT

Intelligence

File Origin
# of uploads :
42
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/70039/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Creating a file
Forced shutdown of a system process
Enabling autorun by creating a file
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/488241
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 296564 Sample: TH5409236BBG.exe Startdate: 12/10/2020 Architecture: WINDOWS Score: 100 28 Antivirus detection for dropped file 2->28 30 Antivirus / Scanner detection for submitted sample 2->30 32 Multi AV Scanner detection for dropped file 2->32 34 8 other signatures 2->34 7 TH5409236BBG.exe 7 2->7         started        process3 file4 20 C:\Users\user\AppData\...\SZnJWlGOgqZIH.exe, PE32 7->20 dropped 22 C:\...\SZnJWlGOgqZIH.exe:Zone.Identifier, ASCII 7->22 dropped 24 C:\Users\user\AppData\Local\...\tmpF096.tmp, XML 7->24 dropped 26 C:\Users\user\...\TH5409236BBG.exe.log, ASCII 7->26 dropped 10 schtasks.exe 1 7->10         started        12 vbc.exe 7->12         started        14 vbc.exe 7->14         started        16 3 other processes 7->16 process5 process6 18 conhost.exe 10->18         started       
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f8db8d7d0f7ba777f5f18452579f40a224a055c6624066b5dce501121cc91c5c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-12 08:14:35 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7dny27ippotxp5prqrjfph2auiskavogmjagnno44uarehgjdroa._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
485c1301f4bc84bc2d274f53222cf7ca5fbd8af8728d1aaa977a6574f577fb87
RemcosRAT
48a5835b51a5221656e9497ca5682a1e232bf1a1da085af917245dc3fad1a241
RemcosRAT
736bd7b09aa1e987edac64868cc8e5db0d86e709652e0588e2023d052f3def8f
RemcosRAT
83eb442b175e4fe5a2fde6e8d72618eee280398f89a81da1f9c118d2c46032d4
RemcosRAT
a64ac7715f779b591f789eb4e66a54a8e8a26855a89089ee6e6080f61231a7c9
RemcosRAT
c8741ad3130b95d1df602e99ed65489df788819dabe8907f2a449197e8ba97ef
RemcosRAT
cb9826fb54d83c293531c905827920511bd9d7b259da01ac1e593d9d10aec334
RemcosRAT
e132699f63854eb3c66be165867f2cafc37d29a8a3a4ca3c4c6949ed42ddde95
RemcosRAT
e39c2e98071d4440d02e6d1aa86111536d6d01554489bd71f890455c05e424d3
RemcosRAT
eb1230ab4a5408a3d264bb51f1ff311fcf52aa97d52b801738cd5add365e77d2
RemcosRAT
+ 798 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
rat family:remcos
Link:
https://tria.ge/reports/201012-tqxplg6xc6/
Behaviour
Creates scheduled task(s)
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetThreadContext
Uses the VBS compiler for execution
Remcos
Unpacked files
SH256 hash:
f8db8d7d0f7ba777f5f18452579f40a224a055c6624066b5dce501121cc91c5c
MD5 hash:
c1d716ce56ac5afbf43c83ac04b07aa5
SHA1 hash:
507dd231828f1ad1dc122696d606bba83fd04d73
Link:
https://www.unpac.me/results/ec63081d-0355-4397-bbd9-b0c64f8383ee/
SH256 hash:
13b24d3a09d099dabe41cd6cd71607a77e14640b1e9b4ed2d60f6c012f191c43
MD5 hash:
109cedae3c384a1913107f1efad2b7c8
SHA1 hash:
1f7f35b0ed85fa12bb839cbce698e59a30813420
Link:
https://www.unpac.me/results/ec63081d-0355-4397-bbd9-b0c64f8383ee/
SH256 hash:
a8d44fc02b2fe9a0e13da34f4f6e0bfda58d18e8e5fdcc317179dd6c18d45a82
MD5 hash:
496c01fd3fb34d1b498fb5c5762ff374
SHA1 hash:
70434d1ee73858711dd2a0587e2704fbf04b2b6f
Link:
https://www.unpac.me/results/ec63081d-0355-4397-bbd9-b0c64f8383ee/
SH256 hash:
f9f61c7e3d00debcc1f37f423f28cd7da2f40422d99b9b55c76e9bb417e35583
MD5 hash:
a523ddeb10dbaee591e6f4fbe860d9c8
SHA1 hash:
bc86026ada2a4a1dcafa11ff610867831f2a511d
Link:
https://www.unpac.me/results/ec63081d-0355-4397-bbd9-b0c64f8383ee/
SH256 hash:
83812c84547d6d6310a649f5ee59a87ad6eed9565edfee170ecc91d7a213fb8b
MD5 hash:
e3aa632995416f65227b96eeb97012b3
SHA1 hash:
5e0f71fcabdf8c094885db40c43b5f9432ca3e72
Detections:
win_remcos_g0
Create hunting rule
win_remcos_auto
Create hunting rule
Link:
https://www.unpac.me/results/ec63081d-0355-4397-bbd9-b0c64f8383ee/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f8db8d7d0f7ba777f5f18452579f40a224a055c6624066b5dce501121cc91c5c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_RemcosRAT
Create hunting rule
Author:abuse.ch
Rule name:Chrome_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Chrome in files like avemaria
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:Parallax
Create hunting rule
Author:@bartblaze
Description:Identifies Parallax RAT.
Rule name:Remcos
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Remcos in memory
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

gz 0e82a28914eba347b95549eb4b7c5d642c2ee6f747407b3a0d8c8c8ff988c215

RemcosRAT

Executable exe f8db8d7d0f7ba777f5f18452579f40a224a055c6624066b5dce501121cc91c5c

(this sample)

  
Dropped by
MD5 19395cd61b67ef935911d4e1ef50e889
  
Dropped by
SHA256 0e82a28914eba347b95549eb4b7c5d642c2ee6f747407b3a0d8c8c8ff988c215
  
Dropped by
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/70039/

Comments