MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c124d47b93d73f9bf5b19516a20019ff3c225625a3e56dfb6a8551ba120eb807. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c124d47b93d73f9bf5b19516a20019ff3c225625a3e56dfb6a8551ba120eb807
SHA3-384 hash: 567dbc34424c459711bdfe4a2cec02bfb2bce96e3b2577fd1b8c31524700a6c01e0ccb5ebee2274022c988d7da2e5a3a
SHA1 hash: 4f69cdbc1865f206df86905df14ad57afc68bbe1
MD5 hash: ec7cbc668549e66cb5487e5ef8867ea7
humanhash: oxygen-march-rugby-oregon
File name:Purchase Order.001
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'245'184 bytes
First seen:2020-03-19 06:30:01 UTC
Last seen:Never
File type: 001
MIME type:application/x-iso9660-image
ssdeep 1536:dAdD8EvtvPTiAUNnfbZ0kX2AOGwvVST2vF:dqAEvF7R2bV3OGwvVSTSF
TLSH 21455B83F240D965D89E863C5D1ACF501217BD6A7991D54B3A8CBB0F2BF30428E6E61F
Reporter cocaman
Tags:001 RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Vebzenpak-7639767-0
Create hunting rule

Win.Trojan.Vebzenpak-7640209-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-03-19 13:32:48 UTC
File Type:
Binary (Archive)
Extracted files:
17
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yesni64t247zx5nrsulkeaaz746cevrfupsw363kqvi3ueqoxadq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c124d47b93d73f9bf5b19516a20019ff3c225625a3e56dfb6a8551ba120eb807

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

001 c124d47b93d73f9bf5b19516a20019ff3c225625a3e56dfb6a8551ba120eb807

(this sample)

RemcosRAT

Executable exe f17d48c8d179de191e519fa908648b977c09f91803b898d8e4fada52e423a8df

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f17d48c8d179de191e519fa908648b977c09f91803b898d8e4fada52e423a8df

Comments