MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 44e43d60a6373cf77fa474d5c4907a30d207a0ff83ee212a1dbb77d0ae8f6777. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 44e43d60a6373cf77fa474d5c4907a30d207a0ff83ee212a1dbb77d0ae8f6777
SHA3-384 hash: 9fe2035f6bb8c26c3c29c158c5bf1a65a5d6c25a8562c204bf5cd600fc2e8780aa6fdcf8143b197de8d91280a4997655
SHA1 hash: a8a193cb08c7e048aa29b883f1b3fbf02b9c3fee
MD5 hash: bcc00684f0eb6ed90713d97773f12566
humanhash: oregon-indigo-vermont-december
File name:000009000000900....pdf.z
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:152'098 bytes
First seen:2021-01-13 07:34:12 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:J7HslYtT3r8cNQZf8LbCpUfqwPKXeu29CFUwpgJNosQS:J7HaYtzrxN2f8vZCdufCFUwKN/
TLSH 40E3123C59C318ABA876219C2DE3307BE789E854DBD6D02D1978E50F14A210FAD9B939
Reporter abuse_ch
Tags:RAT RemcosRAT z


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: hosted-by.rootlayer.net
Sending IP: 45.137.22.52
From: sales@alistekstil.com
Subject: Request for Quotation
Attachment: 000009000000900....pdf.z (contains "000009000000900.exe")

RemcosRAT C2:
45.137.22.52:8780

Intelligence

File Origin
# of uploads :
1
# of downloads :
156
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_exenum416.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/44e43d60a6373cf77fa474d5c4907a30d207a0ff83ee212a1dbb77d0ae8f6777/
Threat name:
Win32.Trojan.Zmutzy
Create hunting rule
Status:
Malicious
First seen:
2021-01-13 07:34:17 UTC
AV detection:
16 of 46 (34.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=itsd2yfgg46po75eotk4jed2gdjapih7qpxcckq5xn35blupm53q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.82
Link:
https://yomi.yoroi.company/submissions/44e43d60a6373cf77fa474d5c4907a30d207a0ff83ee212a1dbb77d0ae8f6777

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip 44e43d60a6373cf77fa474d5c4907a30d207a0ff83ee212a1dbb77d0ae8f6777

(this sample)

RemcosRAT

Executable exe 9a923858b6e0434e961118c2e0b6fc62bfddf64e1fc69b1b8acaa323d27c1d5e

  
Dropping
MD5 881a02cd53c6403a7e543185b29a42f5
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9a923858b6e0434e961118c2e0b6fc62bfddf64e1fc69b1b8acaa323d27c1d5e

Comments