MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 400c3baf67e51f420c62d86957a35595a65ed0c719c51bb16528720fe4a1641e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 400c3baf67e51f420c62d86957a35595a65ed0c719c51bb16528720fe4a1641e
SHA3-384 hash: bbfa976d9240310632d810d728446de688b7176507783eae85bf8d29b37db546e149dbc6502b9ec43bf40b5c5b50498f
SHA1 hash: fcf9d7d49014943369b99cbbdd09571d0e04f68b
MD5 hash: e4359bccd092056f9a593a2dc1a471ce
humanhash: april-venus-network-avocado
File name:REQUEST FOR QUOTATION.xz
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:340'398 bytes
First seen:2021-02-16 18:51:38 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:6QRAVg0goHYsHujgrt5vw2+o0FYmlSoMEwyEzmCDW2U2Mrfdo+LdCOaAHxg0yPH9:6garHdZO2otSoPwfzZO7+WdPH+P02
TLSH FC7423293396396E5F30ED5CD566C6F510BA8723D246C3CD34B359A8EA0BCB6410A86F
Reporter abuse_ch
Tags:RAT RemcosRAT xz


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: mail0.apicalways.xyz
Sending IP: 139.59.255.39
From: Accountant < sales@apicalways.com>
Subject: REQUEST FOR QUOTATION TO SUPPLY ATTACHED PRODUCTS
Attachment: REQUEST FOR QUOTATION.xz (contains "REQUEST FOR QUOTATION.exe")

RemcosRAT C2:
blacice24.ddns.net:5454

Intelligence

File Origin
# of uploads :
1
# of downloads :
269
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs289.UNOFFICIAL
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Fareit-FZO09A1DED20B2A.11837.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/400c3baf67e51f420c62d86957a35595a65ed0c719c51bb16528720fe4a1641e/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-02-16 18:52:07 UTC
AV detection:
19 of 47 (40.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=iagdxl3h4upueddc3buvpi2vswtf5ughdhcrxmlffbza7zfbmqpa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/400c3baf67e51f420c62d86957a35595a65ed0c719c51bb16528720fe4a1641e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip 400c3baf67e51f420c62d86957a35595a65ed0c719c51bb16528720fe4a1641e

(this sample)

RemcosRAT

Executable exe a972b68b050a973ba7815570e6b6d85c20629defc5c4c5bfd3f44abae041feb5

  
Dropping
MD5 1e95524ce703d52a90509af7d3853841
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a972b68b050a973ba7815570e6b6d85c20629defc5c4c5bfd3f44abae041feb5

Comments