MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5193acc4210fdfe9a6adeae9290d5528a7dcba67eada5e536da89d898ee20fef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5193acc4210fdfe9a6adeae9290d5528a7dcba67eada5e536da89d898ee20fef
SHA3-384 hash: d8f3005ba8f0072b950e2692066a29f8ef6cd59a1a6f8acfdc7ea19ececb7df3b98ef652579d9fd359b52ccde6d3c4d6
SHA1 hash: 231ad3429d60a1fbdd8d383997c07afc018389a2
MD5 hash: dee7957216893fd78c3e2424722c76fc
humanhash: potato-fruit-nine-high
File name:Mozoon Tower Project-ORDER.zip
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:121'177 bytes
First seen:2020-12-08 08:05:33 UTC
Last seen:2020-12-10 07:15:33 UTC
File type: zip
MIME type:application/zip
ssdeep 3072:C+BFSYM27m1wHbg9KANA7I6vMs64QjgEIrQW2yCwu+zGk0nKD5HWwq:CcMqm1w7gNz6vV3QjyrQqCwu+zGkjHa
TLSH 28C31237529CCEFF6A7A951684429C84C9D97301FB4E2EC9FD4A48AD8A4619CCE03D1E
Reporter GovCERT_CH
Tags:RemcosRAT

Intelligence

File Origin
# of uploads :
7
# of downloads :
126
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs1999.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5193acc4210fdfe9a6adeae9290d5528a7dcba67eada5e536da89d898ee20fef/
Threat name:
Win32.Backdoor.Rescoms
Create hunting rule
Status:
Malicious
First seen:
2020-12-08 01:23:45 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kgj2zrbbb7p6tjvn5lussdkvfct5zoth5lnf4u3nvcoytdxcb7xq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Zbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5193acc4210fdfe9a6adeae9290d5528a7dcba67eada5e536da89d898ee20fef

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip 5193acc4210fdfe9a6adeae9290d5528a7dcba67eada5e536da89d898ee20fef

(this sample)

RemcosRAT

Executable exe d72b99be6c28cec8f3672df1ef58a69cb08524e181fb7ba53edbdab73f3ccf44

  
Dropped by
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d72b99be6c28cec8f3672df1ef58a69cb08524e181fb7ba53edbdab73f3ccf44
  
Dropping
MD5 464892fe44572f2616f19d8d6f951838

Comments