MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 48b26a6f7efe9e3197153cabbcac69a7b30a6d0d39535835c0841c3bfaa84508. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 48b26a6f7efe9e3197153cabbcac69a7b30a6d0d39535835c0841c3bfaa84508
SHA3-384 hash: c55e70c65e873fa15f23007feee3432df0d40a60b70748d04eaad6d7aa7139c3b7713031d6003f41589a14fa99b4ea0b
SHA1 hash: ccc91ba4922571cd0b50f220d77579bc6e92ce39
MD5 hash: 89a4b8d65eddd94922b0cdff397156e0
humanhash: spaghetti-snake-thirteen-london
File name:AWB___2205280630.jpg.img
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'245'184 bytes
First seen:2020-08-04 08:39:02 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 768:Kr+b2JZx9dRocayMV3DVIvhYnTBqDDj2EG/oX0CAgD6k2P/Wz7sOCb+:Kr42XAyMdyvhYndmDhlETgDr/0OCb
TLSH 8145D61692E40539F267DB714D7416E7813C7C38352DC58BBDEC39AF37B2A488660A27
Reporter abuse_ch
Tags:img RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: ofmacamp.com
Sending IP: 37.49.230.177
From: commercial3@ofmacamp.com
Subject: Revised_ AWB#2205280630
Attachment: AWB___2205280630.jpg.img (contains "AWB # 2205280630.jpg.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Graftor.808153.16574.999.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/48b26a6f7efe9e3197153cabbcac69a7b30a6d0d39535835c0841c3bfaa84508/
Threat name:
Win32.Trojan.GuLoader
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 08:40:08 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jczgu33672pddfyvhsv3zldju6zqu3inhfjvqnoaqqodx6viiuea._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/48b26a6f7efe9e3197153cabbcac69a7b30a6d0d39535835c0841c3bfaa84508

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

img 48b26a6f7efe9e3197153cabbcac69a7b30a6d0d39535835c0841c3bfaa84508

(this sample)

RemcosRAT

Executable exe 0282b710d24b3d098017e3231c93e1b46bf8586a6e0cc83ec76f2a1d710c6813

  
URLhaus
https://urlhaus.abuse.ch/url/424228/
  
Dropping
MD5 ee67cddab302ab6f9a3953f09efa8dfe
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0282b710d24b3d098017e3231c93e1b46bf8586a6e0cc83ec76f2a1d710c6813

Comments