MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 145f5cba8b9f11b5f242510bba1fac7ec9b19553b5fa7b767c70711d93f8a600. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 145f5cba8b9f11b5f242510bba1fac7ec9b19553b5fa7b767c70711d93f8a600
SHA3-384 hash: 99436a703bedf0fc07074d8d4f1ad9c9c6a88c94f53a437eea8b0e92183e49ac18100bd2439473174fc2b467bc06098a
SHA1 hash: c9900fd2d96e8c4a2c3136cd41df4ea4bdfde615
MD5 hash: 909373f01cbf8fd967c3197effdd5717
humanhash: butter-nitrogen-yankee-pasta
File name:Quote.rar
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:540'505 bytes
First seen:2021-02-03 16:06:13 UTC
Last seen:2021-02-03 20:43:56 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:YoL36ztlJj+o28pbmv87FnfBEgSVDpMa84eP9+SqXp7wsGbCFsQYit9:9sbqEJZJa8NP9+SqXBCCFX
TLSH 31B4233DEE2B5DBA7C765A5246DC3CE23D0397EE019AFFAD2224310CE44409E659B724
Reporter abuse_ch
Tags:rar RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: gmail.com
Sending IP: 172.106.111.214
From: devijanakiaol@gmail.com
Subject: Quote
Attachment: Quote.rar (contains "Quote.exe")

RemcosRAT C2:
mynewmachinisonthewaycoming.duckdns.org

Intelligence

File Origin
# of uploads :
2
# of downloads :
103
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/145f5cba8b9f11b5f242510bba1fac7ec9b19553b5fa7b767c70711d93f8a600/
Threat name:
Win32.Trojan.Bingoml
Create hunting rule
Status:
Malicious
First seen:
2021-02-03 16:07:05 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=crpvzoult4i3l4sckef3uh5mp3e3dfktwx5hw5t4obyr3e7yuyaa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/145f5cba8b9f11b5f242510bba1fac7ec9b19553b5fa7b767c70711d93f8a600

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar 145f5cba8b9f11b5f242510bba1fac7ec9b19553b5fa7b767c70711d93f8a600

(this sample)

RemcosRAT

Executable exe 719bb30fb8ff3d79fd0216bdbc9f9d1b377c1456a20c8d9a26f1a19e283352ba

  
Dropping
MD5 40ad293193f34f166e24643536a8d8b6
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 719bb30fb8ff3d79fd0216bdbc9f9d1b377c1456a20c8d9a26f1a19e283352ba

Comments