MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1246a978dcf52cc4316d20012be40508011112c1667c609954a0299b8a4c1f10. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1246a978dcf52cc4316d20012be40508011112c1667c609954a0299b8a4c1f10
SHA3-384 hash: 2e6909fcb120384a11bbf7f879681b22a5b0d301b17fbac2f03ac9415e32d383e6f5bd2ec6a65fdf605e9791df5fa948
SHA1 hash: cbc1f61c3566e9827a2cf0782d4b9249847657bd
MD5 hash: 498020ba342b504fde2cc6fd20e962b2
humanhash: fillet-salami-cardinal-mobile
File name:SLAX3807432211884DL772508146394DO.gz
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:369'965 bytes
First seen:2021-02-19 07:08:33 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:PUGUjSPelNhDxyhDccnR/KQ4lqXA2T/StFJvOT4cObjkEQqiXp1wq6fv6Lrh1LH:tUj0QNh2DZndn4UPD+F5OEcObQIqSu9Z
TLSH 54742363DE18A5CCF62E72363EC36A12DB762EFB08D1865484778E9237DC80ED0959D4
Reporter abuse_ch
Tags:gz RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: mail81.arn-jil.com
Sending IP: 185.189.151.50
From: Nolian Siria<operations@arn-jil.com>
Subject: Incoming shipment via Fedex #934859980854
Attachment: SLAX3807432211884DL772508146394DO.gz (contains "SLAX3807432211884DL772508146394DO.exe")

RemcosRAT C2:
salonirang.duckdns.org

Intelligence

File Origin
# of uploads :
1
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1246a978dcf52cc4316d20012be40508011112c1667c609954a0299b8a4c1f10/
Threat name:
Win32.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-02-19 07:09:07 UTC
AV detection:
16 of 47 (34.04%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cjdks6g46uwmimlneaasxzafbaarcewbmz6gbgkuuauzxcsmd4ia._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1246a978dcf52cc4316d20012be40508011112c1667c609954a0299b8a4c1f10

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

gz 1246a978dcf52cc4316d20012be40508011112c1667c609954a0299b8a4c1f10

(this sample)

RemcosRAT

Executable exe b6e24ae319f72f87dbf9d5e6fc2394737b938f7eb391a39c5043114458f31733

  
Dropping
MD5 98c0e98f67c2d48305bedad1b4664df4
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b6e24ae319f72f87dbf9d5e6fc2394737b938f7eb391a39c5043114458f31733

Comments