MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5a6601efdff120da4216a5aae4b41076662fd50eeee6c37ba6a6d5c673cb4684. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5a6601efdff120da4216a5aae4b41076662fd50eeee6c37ba6a6d5c673cb4684
SHA3-384 hash: 46837f68c00850cde8189e2ddc2837a299ff10e2d656ef91d80b8bf4a5d5723870edb18efa4a70fc93a6f7ce6648e38e
SHA1 hash: 29eb8a4fc3d4b30e3463150483e95b056f2b03a9
MD5 hash: b8e8c5e266275e2f0547a99f89d5f309
humanhash: apart-july-carpet-jersey
File name:0000000000777.zip
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:286'710 bytes
First seen:2021-03-09 15:30:36 UTC
Last seen:2021-03-09 22:58:36 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:dxNVRAFeugtXRMrmx0iz0Q28t6hsqwGTiPEK85ERezSvSt1Xdk:hV0euSXRMKxlz02sJ+P+ZeOFu
TLSH C754235D412C8811F46F18EEA4F9D27A96FCC4C9ED744003916982B32BDAEDD1D3B27A
Reporter GovCERT_CH
Tags:RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
296
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_exenum416.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-03-09 15:31:06 UTC
AV detection:
12 of 47 (25.53%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ljtad3676eqnuqqwuwvojnaqoztc7vio53tmg65gu3k4m46li2ca._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5a6601efdff120da4216a5aae4b41076662fd50eeee6c37ba6a6d5c673cb4684

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip 5a6601efdff120da4216a5aae4b41076662fd50eeee6c37ba6a6d5c673cb4684

(this sample)

RemcosRAT

Executable exe 321e405f4fc6391af017fce9e6964419f05942c84380480e44c20ab9f707dd31

  
Dropped by
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 321e405f4fc6391af017fce9e6964419f05942c84380480e44c20ab9f707dd31
  
Dropping
MD5 64a8ef7734d6a93dbe5d0b99d9a41915

Comments