MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 1035f994f353c85c337bf92e8d673a3eb55437961e47c755bd2e84fe0b12bb30. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RemcosRAT
Vendor detections: 7
| SHA256 hash: | 1035f994f353c85c337bf92e8d673a3eb55437961e47c755bd2e84fe0b12bb30 |
|---|---|
| SHA3-384 hash: | e845d1a7eb873c2b652a568f2b90ee20fe12f3a9d0d65a6c70823931946e9405fc60fb8b36a06817e708ea52da8363ab |
| SHA1 hash: | 780ad13bc50adf14536da51d84c4f5d053f65bfb |
| MD5 hash: | c211b1e8104fb75f5d965ae01054b422 |
| humanhash: | london-kilo-minnesota-lithium |
| File name: | rfq_final_quater_product_purchase_order_import_list_09_09_2024_00000024.7z |
| Download: | download sample |
| Signature | RemcosRAT |
| File size: | 3'156 bytes |
| First seen: | 2024-09-09 07:35:02 UTC |
| Last seen: | Never |
| File type: | zip |
| MIME type: | application/zip |
| ssdeep | 96:n/wk8sUv2gqcU6jauRZKVZtTbWxeb/gmO:4bs22NcU6jJYdKMq |
| TLSH | T1D9514D7F384D9A84F4AB55B3715850D77945548F9D47C9CA261817EC8CD70202A0F5BF |
| Magika | zip |
| Reporter |  cocaman |
| Tags: | 7z QUOTATION RemcosRAT RFQ zip |
cocaman
Malicious email (T1566.001)From: "Edscha Hradec s.r.o. <purchaseworld@sbcglobal.net>" (likely spoofed)
Received: "from s958368.srvape.com (unknown [188.127.224.203]) "
Date: "8 Sep 2024 22:21:41 -0700"
Subject: "RE: final quater Quotation 2024"
Attachment: "rfq_final_quater_product_purchase_order_import_list_09_09_2024_00000024.7z"
Indicators Of Compromise (IOCs)
Below is a list of indicators of compromise (IOCs) associated with this malware samples.
| IOC | ThreatFox Reference |
|---|---|
| 43.226.229.234:57484 | https://threatfox.abuse.ch/ioc/1322530/ |
Intelligence
File Origin
# of uploads :
1
# of downloads :
136
Origin country :
CHFile Archive Information
This file archive contains 1 file(s), sorted by their relevance:
| File name: | rfq_final_quater_product_purchase_order_import_list_09_09_2024_00000024.cmd |
|---|---|
| File size: | 4'662 bytes |
| SHA256 hash: | 7999c1342b845403714e75c797d3b0036c8c1bade2e03b57376ddd4457a113a8 |
| MD5 hash: | 7da44f06b7d550a73212111e49d29359 |
| MIME type: | text/plain |
| Signature | RemcosRAT |
Vendor Threat Intelligence
Detection(s):
Verdict:
Malicious
Score:
81.4%
Tags:
Encryption Execution Network Other Stealth
Result
Verdict:
Unknown
File Type:
ZIP File
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
masquerade
Verdict:
Suspicious
Labled as:
Troj/BatDl
Result
Verdict:
UNKNOWN
Link:
Score:
100%
Verdict:
Malware
File Type:
ARCHIVE
Detection(s):
Suspicious file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
RemcosRAT
zip 1035f994f353c85c337bf92e8d673a3eb55437961e47c755bd2e84fe0b12bb30
(this sample)
cmd Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.