MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b5ed8c993dca9924af15bc03dc018be7263d32ba4cb570b0751d8240d01b8f1f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b5ed8c993dca9924af15bc03dc018be7263d32ba4cb570b0751d8240d01b8f1f
SHA3-384 hash: e200db7516675edbcc146af47d0c31972c7fd2a78e6e295efa73fe7895f53252157bf4a007e3cba9e28d060f562261a7
SHA1 hash: d28ce77d466d0354f06450cb890f65c3ea170182
MD5 hash: b83ee119e23d9dfc415415baeb985fca
humanhash: april-purple-oxygen-washington
File name:C1350094.zip
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:482'823 bytes
First seen:2020-08-19 14:28:41 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:+Pu6uhYe9fRMPCv/R8vKa+FKhZ0g92uyIoh:+WKaKPCv/RYZ/92uyl
TLSH 49A4239B26C1079E71408F60FBD3A3FEDA1B2BD991EC663153F00572AD7AB145C01AE9
Reporter abuse_ch
Tags:nVpn RAT RemcosRAT zip


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: server1.englam.com.sg
Sending IP: 103.11.189.83
From: Wendy <shadongsheng@163.com>
Subject: Re: Attn
Attachment: C1350094.zip (contains "C1350094.exe")

RemcosRAT C2:
salespaul.hopto.org:24005 (194.5.97.12)

Pointing to nVpn:

% Information related to '194.5.97.0 - 194.5.97.255'

% Abuse contact for '194.5.97.0 - 194.5.97.255' is 'abuse@kgb-vpn.org'

inetnum: 194.5.97.0 - 194.5.97.255
netname: NET-NINAZU
remarks: ------------------------------------------
remarks: * This network is used for a VPN service.
remarks: * No logs are stored in any shape or form.
remarks: ------------------------------------------
country: EU
admin-c: NVS100-RIPE
tech-c: NVS100-RIPE
org: ORG-NVS2-RIPE
mnt-by: NINAZU-MNT
status: SUB-ALLOCATED PA
created: 2018-07-23T09:31:45Z
last-modified: 2020-08-02T13:13:48Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b5ed8c993dca9924af15bc03dc018be7263d32ba4cb570b0751d8240d01b8f1f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-19 14:30:07 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wxwyzgj5zkmsjlyvxqb5yaml44td2mv2js2xbmdvdwbebua3r4pq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
QQpass
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b5ed8c993dca9924af15bc03dc018be7263d32ba4cb570b0751d8240d01b8f1f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip b5ed8c993dca9924af15bc03dc018be7263d32ba4cb570b0751d8240d01b8f1f

(this sample)

RemcosRAT

Executable exe 6c62bb193f11ea8626c9c37f1898885271682c15f4bd8d8a7bd7a52fbd67c54e

  
Dropping
MD5 db22c26c58ed7e2622a1e41c660dfcbc
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6c62bb193f11ea8626c9c37f1898885271682c15f4bd8d8a7bd7a52fbd67c54e

Comments