MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5ba45d8c9d5c2a00b6947a7ff864da585a24ac14424d8a05ede8e64683184183. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5ba45d8c9d5c2a00b6947a7ff864da585a24ac14424d8a05ede8e64683184183
SHA3-384 hash: ac88ecdc9cb46ef1b870c9f6b18a16ceb11abe4b7edb12506025e863675ee1103b327ee0d90071579c09e84ca0854c58
SHA1 hash: 0ea81cd72d8ed913c97080db6840d84453b2be60
MD5 hash: 1bd74fa19c87febe98087f47198561b2
humanhash: sierra-echo-fish-yankee
File name:scanned order 1.cab
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:333'625 bytes
First seen:2020-08-11 11:48:54 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:MVSy4i3akTxkt12ljU6vI6T5spmctQjvE5hNHQIhSpD85oc9O3lHfHLn:S1TFK69SRQjyhNBAD1o01z
TLSH 226423313ADDAACBAE22A424026481A5EF978D3961B21FE4FFD5CD3010A5F145C2D978
Reporter abuse_ch
Tags:cab RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: vepo.donoralpha.com
Sending IP: 111.118.214.86
From: sales <sales@rhmsafety.com>
Subject: RFQ 20202792 RHM Safety Co
Attachment: scanned order 1.cab (contains "scanned order 1.scr")

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5ba45d8c9d5c2a00b6947a7ff864da585a24ac14424d8a05ede8e64683184183/
Threat name:
Win32.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2020-08-11 11:50:10 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=losf3de5lqvabnuupj77qzg2lbncjlauijgyubpn5dtenayyigbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/5ba45d8c9d5c2a00b6947a7ff864da585a24ac14424d8a05ede8e64683184183

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar 5ba45d8c9d5c2a00b6947a7ff864da585a24ac14424d8a05ede8e64683184183

(this sample)

RemcosRAT

Executable exe 738ea925d9f26dc03c18efd41de5e310285a36eef0147e7767a25dcf3fb1b24d

  
Dropping
MD5 6c4bb3b95606b439e5e2fb3414c63b70
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 738ea925d9f26dc03c18efd41de5e310285a36eef0147e7767a25dcf3fb1b24d

Comments