MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fdd40bcfba668b785d404214fd35db117b186e21944b24f16540cce86f7bec78. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fdd40bcfba668b785d404214fd35db117b186e21944b24f16540cce86f7bec78
SHA3-384 hash: 77cf67561f8e84a0a3c1bdd7f5d4ab489b7e289e0bcdb1db924a1e4dc57339a355b2e3f2b4449aaeeb40862c2e1c0c44
SHA1 hash: 8f064cf23728b4d445287deb330074d970f4717c
MD5 hash: a7b55a894d41cfe8db40d8550154583a
humanhash: seven-floor-chicken-maine
File name:a7b55a894d41cfe8db40d8550154583a.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:592'416 bytes
First seen:2020-05-19 06:28:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 95a90467276c4ee2609552b9704c6d4b (21 x AgentTesla, 12 x Loki, 1 x NetWire)
ssdeep 12288:b8JsIitBttf+zZa7oPNr3JfjLxEwfwbzXuWI:YaBJeK0r5hVfwbiR
Threatray 1'073 similar samples on MalwareBazaar
TLSH D6C47E22F2F04837D1526E789D1B97689C36BD107A38B9472BF41D4C6F396B33926293
Reporter abuse_ch
Tags:exe RAT RemcosRAT

Code Signing Certificate

Organisation:invalid2.invalid
Issuer:invalid2.invalid
Algorithm:sha256WithRSAEncryption
Valid from:Jan 1 00:00:00 2015 GMT
Valid to:Jan 1 00:00:00 2030 GMT
Serial number: 90768918E93393A0
Thumbprint Algorithm:SHA256
Thumbprint: 67F11429071CCE7564E2E4F06367BE065F657959C8DC2DD6E3DF6833FE2293D8
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
abuse_ch
RemcosRAT C2:
103.133.109.74:3050

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.BehavesLike.Win32.AdwareDealPly.bc.5405.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-19 06:27:02 UTC
File Type:
PE (Exe)
Extracted files:
287
AV detection:
28 of 31 (90.32%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7xkaxt52m2fxqxkaiikp2no3cf5rq3rbsrfsj4lfidgoq3335r4a._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
047ab465004dfd698d0ef47967162e77e6c46b575832d60fab82b440ce8e44e7
RemcosRAT
15199069e1b19301ae6892503f4063aebe5d4303c2b9a848c02d55beb06f54cd
RemcosRAT
62115059096fc430f5e8b4cfe6884444fbb2b0733760a7f4a9856791f1151ba9
RemcosRAT
89313534a5c4579b6a00425281ef0473246cfb2340653bd3cf41b584bfa40578
RemcosRAT
8f326df009924cd7bf93a0a9cb83f1ae42adec4e7afce32971da35a8d792a223
RemcosRAT
97008666a70fcc824511b881a3ac67640fe8c4aa79c21111e40f8d3a9ad54740
RemcosRAT
a40433c26e7cfe28975ff5b5334109e00b8e7ab9bdb8f39818b3d6eb01756978
RemcosRAT
cf0bf4b6a5539d0534f7c833c7f7657ac6cebb7d0e49fdd4cdd135ffc035fbfc
RemcosRAT
d06558cd5d7615d66ea2d806877d962994732909cf003eff4b95d62100840b70
RemcosRAT
d9498f5a8b798490a85fa6878b5c7ac624b75259390ff4504adb52a11b3ea258
RemcosRAT
+ 1'063 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos persistence rat
Link:
https://tria.ge/reports/201109-d1q1p4bpsx/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Drops startup file
Loads dropped DLL
Executes dropped EXE
Remcos
Malware Config
C2 Extraction:
103.133.109.74:3050
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Remcos
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Remcos in memory
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

Executable exe fdd40bcfba668b785d404214fd35db117b186e21944b24f16540cce86f7bec78

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/364758/
  
Delivery method
Distributed via web download

Comments