MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 22907c9bd3e4edb26a8a312d822e28e136e3fcb52328dbd74a0c85c5f142b629. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 22907c9bd3e4edb26a8a312d822e28e136e3fcb52328dbd74a0c85c5f142b629
SHA3-384 hash: 06ed7bd6a435d0afa6eaed4a4f941756ea5cccd76a14dcf86aecfd4c95ddf0ac50ab94b912e25c73895852de266e66cc
SHA1 hash: 2588c9cc54aadfe98cf30aa766f0d0cc6321a3b8
MD5 hash: 6838c42d08fa369c9acb2d453f2bccf6
humanhash: eleven-network-nine-colorado
File name:Quote 620817.zip
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:603'237 bytes
First seen:2022-06-03 05:32:07 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:1Kwwqi/OodZP3F8Sr1dNm2hn7jCt0RHD1AnGySo1F+:1oqml2SUWn7jCORHRBrg+
TLSH T151D4230C6D6C8830F011292CE1D14BD9FBADF9D9F1D6A4FA295AA1FF4C5920D336B605
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter cocaman
Tags:QUOTATION RemcosRAT zip


Avatar
cocaman
Malicious email (T1566.001)
From: "roberts@flowlinkepl.com.au" (likely spoofed)
Received: "from hosted-by.rootlayer.net (unknown [45.137.22.39]) "
Date: "2 Jun 2022 04:35:04 +0200"
Subject: "RE: Quotation- urgent basis"
Attachment: "Quote 620817.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
263
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Tedy.116945.27981.9052.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/62999d100003c05e7e980744/reports/8c82bfd1-67ee-4c31-85a4-99382d8b2d6c/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/22907c9bd3e4edb26a8a312d822e28e136e3fcb52328dbd74a0c85c5f142b629
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/22907c9bd3e4edb26a8a312d822e28e136e3fcb52328dbd74a0c85c5f142b629/
Threat name:
ByteCode-MSIL.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-06-02 01:35:45 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
16 of 41 (39.02%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ekihzg6t4tw3e2ukgewyelri4e3oh7fvemunxv2kbsc4l4kcwyuq._file
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost rat
Link:
https://tria.ge/reports/220603-f8va1ahgh2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Remcos
Malware Config
C2 Extraction:
172.111.234.100:5888
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.38
Link:
https://yomi.yoroi.company/submissions/22907c9bd3e4edb26a8a312d822e28e136e3fcb52328dbd74a0c85c5f142b629

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip 22907c9bd3e4edb26a8a312d822e28e136e3fcb52328dbd74a0c85c5f142b629

(this sample)

RemcosRAT

Executable exe 26a2f8823cf62fe2f297178d880650845074c3de7a3615533e5daeb96cb06bb6

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 26a2f8823cf62fe2f297178d880650845074c3de7a3615533e5daeb96cb06bb6
  
Dropping
RemcosRAT

Comments