MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c74716691ef5025e3bc97356f2d5b5d227449f6d25cc4e0f5b5bb917bfb0c580. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c74716691ef5025e3bc97356f2d5b5d227449f6d25cc4e0f5b5bb917bfb0c580
SHA3-384 hash: 3d2b3d68b659df1e89ce9298e0bc529a711bb6febb3c8f998676e97c191daa8fe4fec0280fb45fc4832be77624a336d4
SHA1 hash: 69f85d3bb6cd0b599cfa67544f42fe0e769f93cd
MD5 hash: 5db425163519c11e387c76395675b12d
humanhash: fix-nebraska-echo-two
File name:C1350095.pdf.z
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:457'070 bytes
First seen:2020-08-18 11:58:11 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:KC/Nb6kgj97AMPnA4SN2jJe2lksy0gfGL/UDK9G1eCwsQyWOeOgE43Eui89LTve:KSlgxs4A4jjJeNEgurUeOx4OjA3hnPe
TLSH F5A42371AA481C15EEC176EE0EDE771ABEEC44F2C598E405D15C3EA14848FE6FCC6858
Reporter abuse_ch
Tags:nVpn RAT RemcosRAT z


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: server1.englam.com.sg
Sending IP: 103.11.189.83
From: arockiamvincent@englam.com.sg
Subject: Re: Attn
Attachment: C1350095.pdf.z (contains "C1350095.exe")

RemcosRAT C2:
salespaul.hopto.org:24005 (91.193.75.25)

Pointing to nVpn:

% Information related to '91.193.75.0 - 91.193.75.255'

% Abuse contact for '91.193.75.0 - 91.193.75.255' is 'abuse@kgb-vpn.org'

inetnum: 91.193.75.0 - 91.193.75.255
netname: NET-NINAZU
remarks: ------------------------------------------
remarks: * This network is used for a VPN service.
remarks: * No logs are stored in any shape or form.
remarks: ------------------------------------------
country: RU
admin-c: NVS100-RIPE
tech-c: NVS100-RIPE
abuse-c: NVS100-RIPE
mnt-by: NINAZU-MNT
mnt-by: RIPE-NCC-END-MNT
org: ORG-KHd1-RIPE
sponsoring-org: ORG-MW1-RIPE
status: ASSIGNED PI
created: 2012-06-04T11:05:55Z
last-modified: 2020-07-28T21:23:48Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c74716691ef5025e3bc97356f2d5b5d227449f6d25cc4e0f5b5bb917bfb0c580/
Threat name:
ByteCode-MSIL.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 12:00:07 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=y5drm2i66ubf4o6jonlpfvnv2itujh3nexge4d23lo4rpp5qywaa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Backdoor
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c74716691ef5025e3bc97356f2d5b5d227449f6d25cc4e0f5b5bb917bfb0c580

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

z c74716691ef5025e3bc97356f2d5b5d227449f6d25cc4e0f5b5bb917bfb0c580

(this sample)

RemcosRAT

Executable exe 92f26df2b8881b2971127cc9bd67d17924b895e4124092d49fdc6ebe4d362620

  
Dropping
MD5 ec70a692fa5b9249165b45658f5c8425
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 92f26df2b8881b2971127cc9bd67d17924b895e4124092d49fdc6ebe4d362620

Comments