MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 35abb523b08d899d6818a51e06966e811f3b5f1936dc6986fdba2edae1b242f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 35abb523b08d899d6818a51e06966e811f3b5f1936dc6986fdba2edae1b242f8
SHA3-384 hash: 6030626c409ee8eb259569670ea13f849a1662e5cc04ba47d0ebc77011c4b958928507cbda6779ae8369042b41fcae92
SHA1 hash: 49fc8e8eb6cf1a2f2b634b27b923385bd3c7374a
MD5 hash: 7347f5b15979a7bc79d1b6922a10b92a
humanhash: carolina-purple-island-harry
File name:Request for quotation and No_863972 order,pdf.lzh
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:409'012 bytes
First seen:2020-08-31 11:00:04 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:F4DKZG5zOeIRzX6CTcdNmSRV2hN1AYTsY:KKZo8idMSShNGY
TLSH 9E94232135075FAF371DF89B1272E22251CA00B2F6B5BA679CE28B700E5CB1B7D56306
Reporter abuse_ch
Tags:lzh RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: s1.servidorlatinoamerica.com
Sending IP: 209.236.113.134
From: Ramadhan Saifullah<marketing@leekeegroup.com>
Subject: URGENT PURCHASE ORDER FOR THAILAND MARKET
Attachment: Request for quotation and No_863972 order,pdf.lzh (contains "Request for quotation and No_863972 order,pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/35abb523b08d899d6818a51e06966e811f3b5f1936dc6986fdba2edae1b242f8/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-31 03:30:19 UTC
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gwv3ki5qrwez22ayuupanftoqeptwxyzg3ogtbx5xixnvynsil4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/35abb523b08d899d6818a51e06966e811f3b5f1936dc6986fdba2edae1b242f8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip 35abb523b08d899d6818a51e06966e811f3b5f1936dc6986fdba2edae1b242f8

(this sample)

RemcosRAT

Executable exe b8de7c07a62506baf48b1b5c799d33341a68117b34f3e5ee31a0ff23e87313f9

  
Dropping
MD5 0013b0f6f384ea57045594fc2aa25e03
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b8de7c07a62506baf48b1b5c799d33341a68117b34f3e5ee31a0ff23e87313f9

Comments