MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f6894107c44af2883f5747f27896ff5c687e4c8a3277f731fac97eafbe2f5a1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4f6894107c44af2883f5747f27896ff5c687e4c8a3277f731fac97eafbe2f5a1
SHA3-384 hash: fd724cc02310fbc9ee8d4767a26c87a859e4e8f92e34bddfc22df9443f42afe7a8b6ac11712c167d81bfef58fd06e03d
SHA1 hash: 8a67f47464fd82f9997bcb8bdcbc25d793b4745d
MD5 hash: 0a8a2e66a4bc199e14596608435f5441
humanhash: burger-floor-uncle-march
File name:Confirmation of order inquiry rar.rar
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:180'317 bytes
First seen:2020-10-26 14:17:48 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:yWPtFkwvZiww02hcOQrAYzWxBXhxG8r+adUzowZNEqfEtNjll82CfvSZ1:yWPtFtvfz2hc9AXDX7QHOrjVC3U1
TLSH A004227117E077EA3408AF1653E77A88A4157229F3B28F0FA409E47807065C505D7AEF
Reporter abuse_ch
Tags:rar RemcosRAT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.nipponcarsrl.com.ar
Sending IP: 200.114.86.103
From: ATL Loizou Group <info@atl-loizou.com>
Subject: ***SPAM*** order inquiry
Attachment: Confirmation of order inquiry rar.rar (contains "Confirmation of order inquiry rar.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4f6894107c44af2883f5747f27896ff5c687e4c8a3277f731fac97eafbe2f5a1/
Threat name:
ByteCode-MSIL.Spyware.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-10-26 07:44:56 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j5ujied4isxsra7vor7spclp6xdipzgiumtx64y7vsl6v67c6wqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar 4f6894107c44af2883f5747f27896ff5c687e4c8a3277f731fac97eafbe2f5a1

(this sample)

RemcosRAT

Executable exe c55730133205122e022bb1681c30d9843889e63bd4f16497f6bbe08f2758e2ba

  
Dropping
MD5 6d6bf1335e34cba12d227c6bdcebcfb8
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c55730133205122e022bb1681c30d9843889e63bd4f16497f6bbe08f2758e2ba

Comments