MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4b8d2c7445168b834631180f59d0bab88be9e44e0e703753f0f15e11e0a6600f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4b8d2c7445168b834631180f59d0bab88be9e44e0e703753f0f15e11e0a6600f
SHA3-384 hash: 90399b5a1b6fdfbb95f1de8aa01c1582ed7a4d0389375b4007d1b2f04bf2d2d7dda90c648f873a176ed2413620996ad4
SHA1 hash: e6c1bc34bcba0cbbd0b2bcd3e24d20b7b8fe3021
MD5 hash: 20fceaaefd006972d41476601ec57588
humanhash: sierra-venus-spring-island
File name:photo.z
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:220'712 bytes
First seen:2020-08-05 11:40:48 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:rcqIiyqD95m/wG14ez2z7dXdQu7VwSdlnH9shnFC5ftzp0/X6uj:rAi1Dzdgz2z7dSMdlHmfpv6uj
TLSH 112423EA366B48053EFA3670887E32C91EC77868DA6A7801CD5F1C7DAD3F4315272562
Reporter abuse_ch
Tags:RAT RemcosRAT z


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: cesales.com
Sending IP: 37.49.229.235
From: Wecon Trading Limited <customerservice@cesales.com>
Subject: Confirm attached document
Attachment: photo.z (contains "photo.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.24199.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4b8d2c7445168b834631180f59d0bab88be9e44e0e703753f0f15e11e0a6600f/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 11:42:10 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jogsy5cfc2fygrrrdahvtuf2xcf6tzcobzydou7q6fpbdyfgmahq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.76
Link:
https://yomi.yoroi.company/submissions/4b8d2c7445168b834631180f59d0bab88be9e44e0e703753f0f15e11e0a6600f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip 4b8d2c7445168b834631180f59d0bab88be9e44e0e703753f0f15e11e0a6600f

(this sample)

RemcosRAT

Executable exe 54091d6f7893b5a42baebba2ea94def14f9181a46544633116be5f1772811236

  
Dropping
MD5 7336e37ed76a80347f757ab29c8b693e
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 54091d6f7893b5a42baebba2ea94def14f9181a46544633116be5f1772811236

Comments