MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4195b37eed546af1c8a65c07f29a94db8332f18d448ed00ac13421db24a85fdb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4195b37eed546af1c8a65c07f29a94db8332f18d448ed00ac13421db24a85fdb
SHA3-384 hash: dbcdef93d02233479e1410b33c641fb68df692bc64f869608ea9b73cc2181f4049a574d6ffed5881903dfffa5b6058cb
SHA1 hash: 50ac79306e05abaa140d68179851f11a39ce5923
MD5 hash: 97e58b6d30d04412cdc061db45ea47fa
humanhash: eight-batman-texas-april
File name:INV001183833.7z
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:187'214 bytes
First seen:2020-04-29 14:03:06 UTC
Last seen:Never
File type: 7z
MIME type:application/x-7z-compressed
ssdeep 3072:uxL1KBC2NHL3q9BUGtbZd2q0BktB8Mz1nCrNZLyip9yRrFcySLKLR2JVYkPK4raB:ux+J69ltKq0W5xeNZLyo9apcyAK4MwKP
TLSH FF0413C6629C1541D695028D110B09F7FC8E70EC8BC3A3595BA57D08CC23AB8FB9B9BC
Reporter cocaman
Tags:7z RemcosRAT


Avatar
cocaman
Malicious email
From: mnino@deluxefreight.com
Received: from cy.cybertechapi.live (cy.cybertechapi.live [77.242.152.50])
Date: Wed, 29 Apr 2020 06:33:38 -0700
Subject: Proforma Invoice No. 4452.
Attachment: INV001183833.7z

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis6279206D8D03.17583.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-29 13:43:35 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
23 of 48 (47.92%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

7z 4195b37eed546af1c8a65c07f29a94db8332f18d448ed00ac13421db24a85fdb

(this sample)

RemcosRAT

Executable exe d9f827863726fb21fd036363b2090e4454776b3ee1a4665d004da0eaa05126e4

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d9f827863726fb21fd036363b2090e4454776b3ee1a4665d004da0eaa05126e4
  
Dropping
RemcosRAT

Comments