MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 5fcd2b75332006a31b954cc43d15ff90e3f1b20baf45deee1577ad4a937fad24. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RemcosRAT
Vendor detections: 7
| SHA256 hash: | 5fcd2b75332006a31b954cc43d15ff90e3f1b20baf45deee1577ad4a937fad24 |
|---|---|
| SHA3-384 hash: | 04f8e3e2f74b9034ac0530e0118aac17f2ed41b14a6c55d18e695a385c41fa0fab3fbc10caeae7ad1863d2ae183a80df |
| SHA1 hash: | 08584cfd1d2d7971e12424e3dd3f5efb9b3334ff |
| MD5 hash: | 1483c650c7aaa6d27338db16fc555a2d |
| humanhash: | lion-failed-kilo-timing |
| File name: | 103_000RTGS224398_0571619530.zip |
| Download: | download sample |
| Signature | RemcosRAT |
| File size: | 477'823 bytes |
| First seen: | 2022-10-28 08:36:41 UTC |
| Last seen: | Never |
| File type: | zip |
| MIME type: | application/zip |
| ssdeep | 6144:5+dricQkVnSf5jGzdUaY6KoU87GJWBzHvjmxUGlOUT8/TmRSbgpcXCV7aaMGJGWd:er1VSwLYVo2Jq0oj/TOSEpc+7aaFEZGf |
| TLSH | T1EAA423519B548AA8B206DD96C35FD8C80BF98C2E07D98FD5035D218CAFE5AE1DB2DD0C |
| TrID | 80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1) |
| Reporter |  cocaman |
| Tags: | RemcosRAT SWIFT zip |
cocaman
Malicious email (T1566.001)From: "contact@ncbagroup.com" (likely spoofed)
Received: "from ncbagroup.com (unknown [171.22.30.10]) "
Date: "26 Oct 2022 20:31:21 +0200"
Subject: "SWIFT Transfer (103) 000RTGS224398"
Attachment: "103_000RTGS224398_0571619530.zip"
Intelligence
File Origin
# of uploads :
1
# of downloads :
191
Origin country :
n/a
File Archive Information
This file archive contains 2 file(s), sorted by their relevance:
| File name: | eqazpeylu.lwh |
|---|---|
| File size: | 7'869 bytes |
| SHA256 hash: | 4c43e66494e77166b952c020288d8d57da8192387114dc091b64f66085fd0054 |
| MD5 hash: | a09675c43ba0475569168ea399e5fc62 |
| MIME type: | application/octet-stream |
| Signature | RemcosRAT |
| File name: | qtjtkjfatja.c |
|---|---|
| File size: | 480'768 bytes |
| SHA256 hash: | 6a6c2784e31fae7f86b3abb8f920a76dbeddc4bd73005006a5d237c008ce5d75 |
| MD5 hash: | b9fa0879a6bcd0b669a1477bb68a4a68 |
| MIME type: | application/octet-stream |
| Signature | RemcosRAT |
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
overlay packed shell32.dll
Result
Verdict:
MALICIOUS
Link:
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Threat name:
Win32.Trojan.GenericML
Status:
Malicious
First seen:
2022-10-26 06:43:56 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
20 of 41 (48.78%)
Threat level:
5/5
Detection(s):
Malicious file
Result
Malware family:
remcos
Score:
10/10
Tags:
family:remcos botnet:remotehoststar persistence rat
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Remcos
Malware Config
C2 Extraction:
41.216.183.226:41900
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
RemcosRAT
zip 5fcd2b75332006a31b954cc43d15ff90e3f1b20baf45deee1577ad4a937fad24
(this sample)
exe Delivery method
Distributed via e-mail attachment
Dropping
RemcosRAT
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.