MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 379b520017f8d847899f5624338300a81d8cc853240a744b41cfceb16b2b39a7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	379b520017f8d847899f5624338300a81d8cc853240a744b41cfceb16b2b39a7
SHA3-384 hash:	5856a8be2060fac46e712c0776d6e9b8a0839091023b161855a20c9e8f11a99f29d270c50f9e04944af0c59f1f02a7fb
SHA1 hash:	6614ff51fbe09dbd6bce7bb7b9240fc34a1af21e
MD5 hash:	95060b91dbe1fce2250e34779b06f1cb
humanhash:	missouri-london-bulldog-dakota
File name:	0YiZbG4343JpgchI1Xjradafwe.rar
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	673'841 bytes
First seen:	2023-03-18 15:43:06 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
Note:	This file is a password protected archive. The password is: 87636017211
ssdeep	12288:sPrzc21/QnesEa5qkddw2/svBA6Q/AOJS7lJxIHHgtyG3d7KYQN8QH9q20DDh+A+:2rzrww2/sva5YqS7lIHAIG3duYZc9l0E
TLSH	T19BE43305FF02EB928B0F6A122EEB429D5CDA674F4BB3A042CD45BA71F611B5CB141729
TrID	58.3% (.RAR) RAR compressed archive (v-4.x) (7000/1) 41.6% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	1ZRR4H
Tags:	pw-87636017211 rar remcos RemcosRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

127

Origin country :

GB

File Archive Information

This file is a password protected archive. The password is: 87636017211

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	0YiZbG4343JpgchI1Xjradafwe.exe
File size:	788'992 bytes
SHA256 hash:	6fe0fe1c59a8435b63996576a0f2d303be85d511a8daa8d0c593e633f602395f
MD5 hash:	4c559d44927bf6259f8774fabb8a7bb1
MIME type:	application/x-dosexec
Signature	RemcosRAT

Vendor Threat Intelligence

DocGuard Unknown

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/379b520017f8d847899f5624338300a81d8cc853240a744b41cfceb16b2b39a7/results/dashboard

FileScan.io

Gathering data

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/379b520017f8d847899f5624338300a81d8cc853240a744b41cfceb16b2b39a7

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/379b520017f8d847899f5624338300a81d8cc853240a744b41cfceb16b2b39a7/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=g6nveaax7dmepcm7kysdhayavaoyzscteqfhis2bz7hlc2zlhgtq._file

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos botnet:quinto rat

Link:

https://tria.ge/reports/230318-vmdtfsfb3s/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Checks computer location settings

Remcos

Malware Config

C2 Extraction:

quinto.con-ip.com:2550

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/379b520017f8d847899f5624338300a81d8cc853240a744b41cfceb16b2b39a7