MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 21e452ec2d61328abd03e03d68781d80b79a08ca6a7dea23d58a9906b172663b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 21e452ec2d61328abd03e03d68781d80b79a08ca6a7dea23d58a9906b172663b
SHA3-384 hash: 1413de056a81aefc08e5af11b1b7156bc9a961a617c4545b7d95d4435bc0531285b9fe08179a2626d265854ae74a3cb2
SHA1 hash: 762829805cd66dd607b41443eac04f1cf6663a28
MD5 hash: 51a44feb3efd130871e0995cece1ff13
humanhash: mobile-video-delaware-hot
File name:REQUEST FOR QUOTE REF -TAI2020504.rar
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:214'927 bytes
First seen:2020-05-04 20:50:00 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:YelWC66jy4Xb9Uirq3hTNW41PQ4z1BQ53/eqH45C95ngQ6zGOOk:dln66jrmyqZUIPLz1OPen5QKD3
TLSH A52422039D92D2D8A7A10190C02B3E5BC5DC877917FEF1FC11919DB68B788DB29F6289
Reporter abuse_ch
Tags:rar RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: cpb2.medionline.cl
Sending IP: 45.55.49.33
From: Mrs. Lai Wu Mei Chu <info@thaibev.com>
Subject: REQUEST FOR QUOTE - REF: TAI2020504
Attachment: REQUEST FOR QUOTE REF -TAI2020504.rar (contains "REQUEST FOR QUOTE REF -TAI2020504.exe")

RemcosRAT C2:
212.83.46.23:3110

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 18:35:25 UTC
File Type:
Binary (Archive)
Extracted files:
48
AV detection:
23 of 48 (47.92%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ehsff3bnmezivpid4a6wq6a5qc3zucgknj66ui6vrkmqnmlsmy5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar 21e452ec2d61328abd03e03d68781d80b79a08ca6a7dea23d58a9906b172663b

(this sample)

RemcosRAT

Executable exe f57374520bfbf5f5afbbfe8c8cf762f95e05cf050fe959d731d49b77f4776cba

  
Dropping
MD5 c886e0ee430adb7f805df32d86d80d71
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f57374520bfbf5f5afbbfe8c8cf762f95e05cf050fe959d731d49b77f4776cba

Comments