MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 649fe0b54e7b7c5820b3898a95ca2b9517afe408c708c03ae1feb23b9b9d3c29. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 649fe0b54e7b7c5820b3898a95ca2b9517afe408c708c03ae1feb23b9b9d3c29
SHA3-384 hash: 172600ec10ab221cead847dd1db519f751c6e85b8e8be26c14a281c32505b038bb3c05f16b44dcca71aafcfa97b84498
SHA1 hash: 4d0f81b8b3c50bf323b0815d25457deaffa13fd5
MD5 hash: 1f3676e15bda04f36cb10e8ac64d4c06
humanhash: salami-kilo-idaho-maryland
File name:dhl_customer_form.jpg.ace
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:390'849 bytes
First seen:2020-07-01 05:06:22 UTC
Last seen:Never
File type: ace
MIME type:application/octet-stream
ssdeep 6144:ukS0UgNEx4PwcvxIpRLzBx5+x+ZAb27MuS0FAIPpHCCPDpcMxH9z9iX6P:ukSZx5BTL3e+Zb1plrfz966P
TLSH 7484238B829D3F4355BD33C9948CD809F5947C609AC162536EE2BE45BA4FD2ABC8C1D8
Reporter jarumlus
Tags:RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/649fe0b54e7b7c5820b3898a95ca2b9517afe408c708c03ae1feb23b9b9d3c29/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-06-30 19:51:00 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

ace 649fe0b54e7b7c5820b3898a95ca2b9517afe408c708c03ae1feb23b9b9d3c29

(this sample)

RemcosRAT

Executable exe d9e6d184148b47fd32eb6810a21ea8ee0b04d2cb5315d4a4cfbf12fe86ac67ab

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d9e6d184148b47fd32eb6810a21ea8ee0b04d2cb5315d4a4cfbf12fe86ac67ab
  
Dropping
MD5 52e71e22fa49e223c9a36ee2cd98ae56

Comments