MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 293f90fc550689f46c39bb87ca866648086ff32786890a8a63de1ef4f983a07e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 293f90fc550689f46c39bb87ca866648086ff32786890a8a63de1ef4f983a07e
SHA3-384 hash: 15cc4b4ce906a06a284466a8d09bfc3e13eebb309749a29ac784814eb50aa86a951230436640f0c926a02b87ed6a21f4
SHA1 hash: 5faf46cc4efce63375fa10a7255ac0bb36136985
MD5 hash: 84f52e6c293da20e0a5ef6b41e79f0aa
humanhash: glucose-asparagus-eighteen-whiskey
File name:QuoteInvoice.zip
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:149'027 bytes
First seen:2020-08-05 08:09:43 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:D0FL/219Jf5wanyivLgi/PZKAK1TH5uz4KvBccj6umbLUDVuZ:D0FL+1zf5wAhvLgGZaTH5g55+bLUDVy
TLSH 56E312810F6B28944A97348F34BA7532F88B5D41E489BCA316F8D4F4FFD9354A34CA4A
Reporter abuse_ch
Tags:RAT RemcosRAT zip


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: slot0.gammersd.xyz
Sending IP: 104.168.236.98
From: Sales Manager <info@gammersd.xyz>
Reply-To: reinaluis55@yahoo.com
Subject: Please send me your best favourable prices 11
Attachment: QuoteInvoice.zip (contains "Quote&Invoice.pif")

RemcosRAT C2:
185.172.111.213:27015

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject3.48374.4417.659.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/293f90fc550689f46c39bb87ca866648086ff32786890a8a63de1ef4f983a07e/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 05:21:09 UTC
AV detection:
28 of 48 (58.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fe7zb7cva2e7i3bzxod4vbtgjaeg74zhq2eqvctd3yppj6mdub7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/293f90fc550689f46c39bb87ca866648086ff32786890a8a63de1ef4f983a07e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip 293f90fc550689f46c39bb87ca866648086ff32786890a8a63de1ef4f983a07e

(this sample)

RemcosRAT

Executable exe 4ea16682c6d48eb737c1857beceadc3d3077921c03fa62d9dad44d551d92729d

  
Dropping
MD5 1fbf74602dd86ce47486ccfd07d8d949
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4ea16682c6d48eb737c1857beceadc3d3077921c03fa62d9dad44d551d92729d

Comments