MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 403c40c6f52407bbadeaeb1d0e53e03c3fa0210513e844c23e0b6c2e72d1591a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 403c40c6f52407bbadeaeb1d0e53e03c3fa0210513e844c23e0b6c2e72d1591a
SHA3-384 hash: 59ed509378a35297f719dc97e3b0169647fc7134a30e4f282941be521022a039e43ae3f4f07610ea23565f405946719a
SHA1 hash: 9fd14fc661e738ca786eb0abd89ebd06f81a4512
MD5 hash: d624c7c431a61d59e0685a90405b3d60
humanhash: nebraska-december-single-nebraska
File name:PO NO. MKL1-20-06053 TECHNICAL SPECIFICATION.rar
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:478'998 bytes
First seen:2021-01-11 09:00:38 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:A5mc7Xse8bwGNrnIz0h7kmzx5ssM/z6w8H4b5QYd:A5mcNLGNrIzOd8sRHi5/d
TLSH FBA423A270AE8B3E38E2331C7A41DE5CDB44F4AF313622B5D14629535BB32B673514A7
Reporter abuse_ch
Tags:rar RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: mailblock3.hostneverdie.com
Sending IP: 27.254.41.200
From: Abhijeet P. Gade <mohsen@alhayatice.com>
Subject: PO MKL1-20-06053_WO_201065
Attachment: PO NO. MKL1-20-06053 TECHNICAL SPECIFICATION.rar (contains "PO NO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe")

RemcosRAT C2:
212.83.46.26:4023

Intelligence

File Origin
# of uploads :
1
# of downloads :
130
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/403c40c6f52407bbadeaeb1d0e53e03c3fa0210513e844c23e0b6c2e72d1591a/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-01-11 09:01:16 UTC
AV detection:
6 of 46 (13.04%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ia6ebrxveqd3xlpk5moq4u7ahq72aiifcpuejqr6bnwc44wrlena._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/403c40c6f52407bbadeaeb1d0e53e03c3fa0210513e844c23e0b6c2e72d1591a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar 403c40c6f52407bbadeaeb1d0e53e03c3fa0210513e844c23e0b6c2e72d1591a

(this sample)

RemcosRAT

Executable exe d93d98295e3aebd631b2fd6d1a47ddd5ed0597343bf2c0ed870d6bdb59cb6192

  
Dropping
MD5 a3d8e6527b3cd4d2e74539af7918fc34
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d93d98295e3aebd631b2fd6d1a47ddd5ed0597343bf2c0ed870d6bdb59cb6192

Comments