MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 44c3938b15f736f8eedf6f1ba83aea1443dac545f54cdfd47085bd73f366ca01. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 44c3938b15f736f8eedf6f1ba83aea1443dac545f54cdfd47085bd73f366ca01
SHA3-384 hash: 699dbc83580c9678f77f4195870edacb7d1ffe6e3fcb3d2766777b762a0bf2269e47dcbda19b71f40bd528147b6e85a7
SHA1 hash: 0ffaad46d1d55fe3a7a02c9378a3cff5c0e88647
MD5 hash: e96d89d3ac6141a6319f316a5c1050a1
humanhash: princess-cold-papa-ink
File name:Quotation 77028_20210305.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'245'184 bytes
First seen:2021-03-06 06:04:26 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:gDSjwx6OywSY8Rp10LKifVwLC9WQTKhxgmUXcSxvyfwGz6uiTB0x:4sRp10LzfVSC9WMKhxgLcisz6TBy
TLSH EF45CF41635482A5EFEC1BF46566D0C41375A1DA1C8FE3142D0AA4EC2AFEB6E34D38E7
Reporter abuse_ch
Tags:iso RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: slot0.julislinq.com
Sending IP: 194.31.96.36
From: Sales01 - PURCHASE <sales@julislinq.com>
Subject: RFQ/2021/03/05/Quotation/NEW ORDER/77028_2021030 APRIL DELIVERY 07
Attachment: Quotation 77028_20210305.iso (contains "uitTYe3ZE5EMN3Z.exe")

RemcosRAT C2:
sandshoe.myfirewall.org

Intelligence

File Origin
# of uploads :
1
# of downloads :
181
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.45842369.2494.6696.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/44c3938b15f736f8eedf6f1ba83aea1443dac545f54cdfd47085bd73f366ca01/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-03-06 03:53:37 UTC
AV detection:
11 of 43 (25.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=itbzhcyv643pr3w7n4n2qoxkcrb5vrkf6vgn7vdqqw6xh43gziaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.98
Link:
https://yomi.yoroi.company/submissions/44c3938b15f736f8eedf6f1ba83aea1443dac545f54cdfd47085bd73f366ca01

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso 44c3938b15f736f8eedf6f1ba83aea1443dac545f54cdfd47085bd73f366ca01

(this sample)

RemcosRAT

Executable exe 8737cdfdcf2aa430ccfa6b2c1834a3c0768c201f4a77e3e5315e2bdbc3134a68

  
Dropping
MD5 ceda33d4054ecb6658a9fc66d1717707
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8737cdfdcf2aa430ccfa6b2c1834a3c0768c201f4a77e3e5315e2bdbc3134a68

Comments