MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 784373a364ed40c42ab74f891ee63ed7457e283871e9888a03002a469ba3b629. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 784373a364ed40c42ab74f891ee63ed7457e283871e9888a03002a469ba3b629
SHA3-384 hash: fe18477355788cd31da268246e2c4e6ebfaa5ea41a02909158693fe9ea11e7aaa451c9b377ef37a9119efda0940732c3
SHA1 hash: 0b41bfe68077174f93b5e7f3317c05917a4d7d15
MD5 hash: 58bfa67d9af44324dc33b31228308e92
humanhash: undress-florida-pluto-six
File name:IMG-BANK-00878-000067-9089.rar
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:296'590 bytes
First seen:2020-08-14 15:36:29 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:H7HdHHof+8yg7y99dXiYmFhuE3FHFVN8ZLXcRp4LfGFXzX5vi5quWPmyv:H79Hy+5gW99tiFqE3dN8ZLscKXNK5q2W
TLSH 2D5423AA3A47579F172CD1F8EACA6D2FBE898455FD0098A0BF5B44A3F06D02550FC835
Reporter abuse_ch
Tags:rar RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: aerosoftint.ae
Sending IP: 139.64.247.73
From: Jangjoo Group of Companies< info@aerosoftint.ae>
Subject: Payment Details
Attachment: IMG-BANK-00878-000067-9089.rar (contains "IMG-BANK-00878-000067-9089.exe")

RemcosRAT C2:
www.valjan.in:5200 (185.19.85.183)


% Information related to '185.19.84.0 - 185.19.85.255'

% Abuse contact for '185.19.84.0 - 185.19.85.255' is 'abuse@datawire.ch'

inetnum: 185.19.84.0 - 185.19.85.255
netname: DATAWIRE-DATACENTERS
descr: CUSTOMERS ZG01
country: CH
admin-c: DA4314-RIPE
tech-c: DA4314-RIPE
status: ASSIGNED PA
mnt-by: DATAWIRE-NOC
created: 2013-09-23T14:18:55Z
last-modified: 2013-09-23T14:18:55Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/784373a364ed40c42ab74f891ee63ed7457e283871e9888a03002a469ba3b629/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-14 15:38:06 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pbbxhi3e5vamikvxj6er5zr625cx4kbyohuyrcqdaaveng5dwyuq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/784373a364ed40c42ab74f891ee63ed7457e283871e9888a03002a469ba3b629

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar 784373a364ed40c42ab74f891ee63ed7457e283871e9888a03002a469ba3b629

(this sample)

RemcosRAT

Executable exe 81b135119adbe6ad608d9d31aff02e931324c4af47e630c38bb8056c74ee254a

  
Dropping
MD5 30e337c43572c08f8250ce8f396587ec
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 81b135119adbe6ad608d9d31aff02e931324c4af47e630c38bb8056c74ee254a

Comments