MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4bf61c5bf74d42fe00c49f31f2b94ef2b7c6316fe1890c391a8763ce522c75fb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4bf61c5bf74d42fe00c49f31f2b94ef2b7c6316fe1890c391a8763ce522c75fb
SHA3-384 hash: 8d77c105370fe3268b3dfdfb312200da96a36892812f3472a40beb3fd0f9f0ea5b52a29632972053f5e3d021d050a0e5
SHA1 hash: 7d2fd70e1bbae49edc1f44a31fbaa1567646697d
MD5 hash: 64e456891de60154d05be65244c414b0
humanhash: yankee-nitrogen-king-saturn
File name:UAEOder082020_copy.rar
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:129'812 bytes
First seen:2020-08-05 06:55:41 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:8V7JORzZT06ZDHbOd5st4ZAJ25j1zQOK3TWnDB8ChPH:yJORNIkD7OD84Zu2Lm3SDB7PH
TLSH 11C3123F577BB6C590DCF8124C68EA24527EAF830EC092FBD62A4D055AD7521236171F
Reporter abuse_ch
Tags:rar RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: cloudhost-77552.us-midwest-1.nxcli.net
Sending IP: 209.126.25.80
From: prmtn@telusplanet.net
Subject: UAE 请报价
Attachment: UAEOder082020_copy.rar (contains "UAEOder082020_copy.scr")

RemcosRAT C2:
172.94.44.202:6606

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4bf61c5bf74d42fe00c49f31f2b94ef2b7c6316fe1890c391a8763ce522c75fb/
Threat name:
ByteCode-MSIL.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 06:56:10 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jp3byw7xjvbp4aget4y7foko6k34mmlp4geqyoi2q5r44urmox5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4bf61c5bf74d42fe00c49f31f2b94ef2b7c6316fe1890c391a8763ce522c75fb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar 4bf61c5bf74d42fe00c49f31f2b94ef2b7c6316fe1890c391a8763ce522c75fb

(this sample)

RemcosRAT

Executable exe 4692d4716a224f54c928808d2d7ee7e9eaeb8531f1cd29b91886fa511a12f07a

  
Dropping
MD5 4c17a5d2e9ef84a1b5023615ab26ae5c
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4692d4716a224f54c928808d2d7ee7e9eaeb8531f1cd29b91886fa511a12f07a

Comments