MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0fd52ebb37e4e5c41756133e47215547478097f9a6ff170cc442cb21276e3f36. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0fd52ebb37e4e5c41756133e47215547478097f9a6ff170cc442cb21276e3f36
SHA3-384 hash: c0b958f748eb4b4571b886f3457885a9df8141a7551f0c64dcd5d025410fed77f858f764a9ae81eca4f8135c01a320a6
SHA1 hash: ba1a39bcedd7ddc7f069e96e220035d5c4844d32
MD5 hash: 58b04d71e53c817574f1c8b9abd9620f
humanhash: rugby-blue-venus-connecticut
File name:Promac S.A.220172615415415.PNG
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'195'443 bytes
First seen:2024-02-09 13:05:40 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 24576:A/s41GsJNI55p3HbCgVQu7hdmr1ObrhzE24b/x:p41GkybCguue1yhg
TLSH T14D45F12B5EC6B995C1998933B3A955DC02F59E2FBCC5E367188C72F4CB3538D22025A3
Reporter e24111111111111
Tags:cab RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
113
Origin country :
GR GR
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:x.exe
File size:1'195'008 bytes
SHA256 hash: 757f69d91f0adbbb195ec6221e8af7d89a64a58f0bbd93bc365763126028550e
MD5 hash: b764b79d420d29a637abecef64cf8ca3
MIME type:application/x-dosexec
Signature RemcosRAT
Vendor Threat Intelligence
Verdict:
Unknown
Threat level:
  0/10
Confidence:
60%
Tags:
CAB installer
Link:
https://www.filescan.io/uploads/65c6233c31039a85aad94b2e/reports/9449238b-a1e2-460f-9954-e0f93ef38b99/overview
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/0fd52ebb37e4e5c41756133e47215547478097f9a6ff170cc442cb21276e3f36
Result
Verdict:
MALICIOUS
Score:
81%
Verdict:
Malware
File Type:
Archive
Link:
https://malprob.io/report/0fd52ebb37e4e5c41756133e47215547478097f9a6ff170cc442cb21276e3f36
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0fd52ebb37e4e5c41756133e47215547478097f9a6ff170cc442cb21276e3f36/
Threat name:
Win32.Trojan.Remcos
Create hunting rule
Status:
Malicious
First seen:
2024-02-08 11:22:52 UTC
File Type:
Binary (Archive)
Extracted files:
40
AV detection:
6 of 24 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=b7ks5ozx4ts4if2wcm7eoikvi5dybf7zu37rodgeilfscj3oh43a._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/240209-teg1gaed79/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.15
Link:
https://yomi.yoroi.company/submissions/0fd52ebb37e4e5c41756133e47215547478097f9a6ff170cc442cb21276e3f36

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar 82242a1cf275f1c2f798069535e2e1dff5ad11b5a669ca7d5b133c3073223842

RemcosRAT

cab 0fd52ebb37e4e5c41756133e47215547478097f9a6ff170cc442cb21276e3f36

(this sample)

DarkTortilla

Executable exe b271fd4baccf44412c3a92f97f16b996248c3c1706bfd29694253ba01ab65fae

  
Dropping
SHA256 b271fd4baccf44412c3a92f97f16b996248c3c1706bfd29694253ba01ab65fae
  
Dropped by
SHA256 82242a1cf275f1c2f798069535e2e1dff5ad11b5a669ca7d5b133c3073223842
  
Dropped by
MD5 99b517d910d9d0d8ed8d28b7373932a2

Comments