MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 01cca1f337c187c205f8d9eb483f3e9af291b3c6309eaf0b48c1a2964564eb6c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 01cca1f337c187c205f8d9eb483f3e9af291b3c6309eaf0b48c1a2964564eb6c
SHA3-384 hash: 388c606731b6255285662cc739e0d322de56b224292655c39732d679d5825b82ef624c4bb9585895e86d1caae6db7d68
SHA1 hash: ef6b39cdfa29620cd4ec9f88613b0835b594e301
MD5 hash: c7a84d9e0d14f35ca6fbccd7038015f3
humanhash: connecticut-burger-burger-bulldog
File name:Pay check error.img
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:2'359'296 bytes
First seen:2021-01-06 07:16:57 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 3072:MTgYDscwoO+AqFLpr/70CzBKcJ2XO9rISUyuo1KP1:7c8zqFtNKK2e1ISUs6
TLSH 1CB583056FD3254EF2F7E07612B19ADAAF78FB7A32409A0D865D2A550C03F462F93D06
Reporter abuse_ch
Tags:img Rackspace RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: smtp79.iad3a.emailsrvr.com
Sending IP: 173.203.187.79
From: starrsmill@snapfitness.com
Subject: Payroll Correction
Attachment: Pay check error.img (contains "Oral-Action.scr")

Intelligence

File Origin
# of uploads :
1
# of downloads :
187
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Backdoor.tz.31847.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/01cca1f337c187c205f8d9eb483f3e9af291b3c6309eaf0b48c1a2964564eb6c/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-01-05 21:22:42 UTC
AV detection:
5 of 46 (10.87%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ahgkd4zxygd4ebpy3hvuqpz6tlzjdm6ggcpk6c2iygrjmrle5nwa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/01cca1f337c187c205f8d9eb483f3e9af291b3c6309eaf0b48c1a2964564eb6c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

img 01cca1f337c187c205f8d9eb483f3e9af291b3c6309eaf0b48c1a2964564eb6c

(this sample)

RemcosRAT

Executable exe fd16b4767d7764fde593f6b7d6449ccb233c18270bf45d67edde500c5028dc94

  
Dropping
MD5 1ba47e918f50f837096de2379c5d5150
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fd16b4767d7764fde593f6b7d6449ccb233c18270bf45d67edde500c5028dc94

Comments