MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 006f4b8cfdf16471b8c4f07c010d2ce2ed61c332f9ea2ab09035ef2a1e029a17. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 006f4b8cfdf16471b8c4f07c010d2ce2ed61c332f9ea2ab09035ef2a1e029a17
SHA3-384 hash: 501af480917a85881130a90ae6b7cb0081259d724d192cc62b027cb0a3668c10db4134ed4c0f525af8c04b0af2ff7591
SHA1 hash: 136e4b00f377691ff942717ca51c9ff8fa6527c9
MD5 hash: 655e3886a2376a4f6472443f34ad8946
humanhash: pluto-delta-white-washington
File name:09009000090..pdf.z
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:122'820 bytes
First seen:2021-01-14 20:09:32 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:uY8tHH8o1SGfhwDcwUDNWtCQPVr3B6xTkO:P21S2hJpN4tDBeTP
TLSH 01C31249D7B5BDDC592A85FB1EED5B88698172162428C3428FFCBAC429F772E05010FE
Reporter abuse_ch
Tags:geo RAT RemcosRAT TUR z


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: hosted-by.rootlayer.net
Sending IP: 185.222.58.152
From: ekstre@eekstre.qnbfinansbank.com
Subject: CardFinans KOBİ Visa Aralık ayi ekstreniz.
Attachment: 09009000090..pdf.z (contains "09009000090.exe")

RemcosRAT C2:
72.11.157.241:4445

Intelligence

File Origin
# of uploads :
1
# of downloads :
154
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_exenum416.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/006f4b8cfdf16471b8c4f07c010d2ce2ed61c332f9ea2ab09035ef2a1e029a17/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=abxuxdh56fshdoge6b6acdjm4lwwdqzs7hvcvmeqgxxsuhqctilq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/006f4b8cfdf16471b8c4f07c010d2ce2ed61c332f9ea2ab09035ef2a1e029a17

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip 006f4b8cfdf16471b8c4f07c010d2ce2ed61c332f9ea2ab09035ef2a1e029a17

(this sample)

RemcosRAT

Executable exe 1619a67b0219aac78f1e5e8ac86ec2cf68641ba65a19653fc176916275b6f6ad

  
Dropping
MD5 f6ecf089089d159be0094b2df9450419
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1619a67b0219aac78f1e5e8ac86ec2cf68641ba65a19653fc176916275b6f6ad

Comments