MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4fac48a4dee43b19e11ec467028b4d95ad80accb114e7f2374d0642ce25319c9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4fac48a4dee43b19e11ec467028b4d95ad80accb114e7f2374d0642ce25319c9
SHA3-384 hash: 5ad3070915600fa61e2839106d92a7606f04c7b4f59e188f2ae45d60b1223eefa019d616f27828bc6c59cef08f925941
SHA1 hash: 8272a9cb05bc78c2f596073d28affeaf81b766b8
MD5 hash: 90770a18e60c40f789262cd0b0c47b7e
humanhash: blossom-august-floor-mississippi
File name:H.S.L Urgent RFQ 435788446864,pdf.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:731'648 bytes
First seen:2020-06-02 18:20:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 724b752ce0fa3ad87e4fd6a599bf8e0e (6 x RemcosRAT)
ssdeep 12288:4Va3OouGLMvxj4ZV0Ebhs34epfCAyrWThyzfYQ9YYiHdfY:4VdouXxjWSEbhsba6Th4v3Wd
Threatray 1'477 similar samples on MalwareBazaar
TLSH 44F48E33F6E04437D22329799C0BA7B5A93ABE113E24AA4627ECCD9C4F7D7417529183
Reporter jarumlus
Tags:RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 18:35:26 UTC
AV detection:
24 of 47 (51.06%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j6werjg64q5rtyi6yrtqfc2nswwyblglcfhh6i3u2bsczystdheq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
1ea80e0718c74846253ea8a2cd308d8c7412d3baf6b23710f4e166c0f34076ce
RemcosRAT
3667e6ce369da2c3028286f4526ee7995fa618bf56b37b80aa3554227710e1e4
RemcosRAT
3b13ea61e91a0312f8c187096e435168cee2d2277c46373d01899497345bd0e9
RemcosRAT
667d35d2cff2979ca84df0afe1eca6c164e1d919b989e16b97166c7a30c77a87
RemcosRAT
93c327b46d6354a91a9b20311a2f1e1873e132765816ec26443eb1971ccd2946
RemcosRAT
b8a03fd14b3a3695af8b6c781eb946214a98986279678c6b2a477f22ba1ac3cf
RemcosRAT
c0a656a2f73c254ed2f1e73630083849890b7c1e36161e89fe29d2fd014f9fff
RemcosRAT
c7095f2c5ed61c9d667c69aba9d9bc5b87b93f7fad5f49b1d5c66c4eb11b745e
RemcosRAT
dd6cc40b98ec4d9c1413705c105d03f94afcfdc1258a5ab8c39342e71f67e2f9
RemcosRAT
f9441d3651d67748ec1a2fd325ea1aa9d914208c7fae0853e5b769e52e66ccb8
RemcosRAT
+ 1'467 additional samples on MalwareBazaar
Result
Malware family:
modiloader
Create hunting rule
Score:
  10/10
Tags:
family:modiloader
Link:
https://tria.ge/reports/201109-7zb3egwxj6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Legitimate hosting services abused for malware hosting/C2
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

f4877edaa048efef7fd98396a53e67c250eaacc9e3e2d1a747dd43660d34396e

RemcosRAT

Executable exe 4fac48a4dee43b19e11ec467028b4d95ad80accb114e7f2374d0642ce25319c9

(this sample)

  
Dropped by
MD5 1fcd728228635cd3f28f5bc6f5bb5ce8
  
Dropped by
SHA256 f4877edaa048efef7fd98396a53e67c250eaacc9e3e2d1a747dd43660d34396e
  
Delivery method
Distributed via e-mail attachment

Comments