MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 597c4b4f5a047a75c9498ca9887cf7fc745861318d5814d6a1e77a72a55d2cfb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 597c4b4f5a047a75c9498ca9887cf7fc745861318d5814d6a1e77a72a55d2cfb
SHA3-384 hash: 505490e78dd13685ce0c052fa94bfce7fbe3b5820f7ee01f70246191935885d770c6fc7fb0bf22d49672e34e0bc7ce37
SHA1 hash: 6123f8cb5bf4817fda5128f78b97eee85b4d44c5
MD5 hash: 6c92ad97157e96a3f3c482432f4dabeb
humanhash: kentucky-harry-johnny-idaho
File name:TT-INVI000000000.zip
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:644'958 bytes
First seen:2021-03-09 16:20:38 UTC
Last seen:2021-03-09 23:47:37 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:Yz9QkEHM55V0rUyUyERnL2yEhOtrTFx5A31pYh/z+zbbGE+a4kfMpBd+po:YRhEsrOr/UpLDEklX512bpObd+W
TLSH 00D423CC5D879D50AD84E0BDC8A7F34182CCCE81DA7758A92DC9B10A8548261F6BF7DB
Reporter GovCERT_CH
Tags:RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
321
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.36472869.14678.20446.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Threat name:
Win32.Trojan.Spynoon
Create hunting rule
Status:
Malicious
First seen:
2021-03-08 15:28:25 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lf6ewt22ar5hlskjrsuyq7hx7r2fqyjrrvmbjvvb455hfjk5ft5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Eldorado
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/597c4b4f5a047a75c9498ca9887cf7fc745861318d5814d6a1e77a72a55d2cfb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip 597c4b4f5a047a75c9498ca9887cf7fc745861318d5814d6a1e77a72a55d2cfb

(this sample)

RemcosRAT

Executable exe 811d169ec93c76795798353e6fdf509271d61d3424acb7d709c34cc83511b0f9

  
Dropped by
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 811d169ec93c76795798353e6fdf509271d61d3424acb7d709c34cc83511b0f9
  
Dropping
MD5 a9fe1629c98954b6af37d55141373d25

Comments