MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 016b23c866e142cd814a3407c95cded40a9414ef661c7c111ff6a0b731db4a3c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 016b23c866e142cd814a3407c95cded40a9414ef661c7c111ff6a0b731db4a3c
SHA3-384 hash: a176e687c2764e9b5bbd2d71100b1e9860d41c274ce2975e8675fe97e67db11b0bf6345ba7d5ba08afd9218a8217d322
SHA1 hash: a2ee9b579804e357ebac2382088aa4b6819247af
MD5 hash: dc3a3608ce6c0f65b58e5ecda9d4d699
humanhash: michigan-island-king-illinois
File name:CQ GGM 41pcs F2.doc.arj
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:393'773 bytes
First seen:2020-11-06 17:41:32 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:nmTu0oPTlQVKraBZ+xtXon6gy19ERcabv1um+4QrJG6YZtruKnpchz+WRx:CzoPdWBZIx92um+4yG6Ynru1hz+Q
TLSH E38423DFECC6E715D65AD3A14AF41E826848EB594D935ED740EFE2E62C81EDF02880C1
Reporter abuse_ch
Tags:arj RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: mark.com
Sending IP: 173.249.47.215
From: GGM - USA <glynn@joyceswift.cf>
Subject: Re: New Order / Sales contract
Attachment: CQ GGM 41pcs F2.doc.arj (contains "CQ GGM 41pcs F2doc.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

PUA.Win.Adware.Browserio-6725861-0
Create hunting rule

SecuriteInfo.com.Artemis162931E90DCF.4593.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/016b23c866e142cd814a3407c95cded40a9414ef661c7c111ff6a0b731db4a3c/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-11-06 16:49:18 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=afvshsdg4fbm3akkgqd4sxg62qfjifhpmyohyei762qlomo3ji6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip 016b23c866e142cd814a3407c95cded40a9414ef661c7c111ff6a0b731db4a3c

(this sample)

RemcosRAT

Executable exe 2db8a74e308420eb383bc8c609a8652b7a46fc70119cf5152259592c2dcf27fa

  
Dropping
MD5 ea6372f32f4211dafa615f74fc046b16
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2db8a74e308420eb383bc8c609a8652b7a46fc70119cf5152259592c2dcf27fa

Comments