MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 67c8f49fce382123118d051892f7ac638a6cf67423adc0dca2db514e9c89b570. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 67c8f49fce382123118d051892f7ac638a6cf67423adc0dca2db514e9c89b570
SHA3-384 hash: fa21326ab25d1a3fc1d554f360403d4876c63ed3a60061a082c01ec045f52f79fdbe345f9c335272a9d1b1ec7dfb1785
SHA1 hash: bcb4854e77aa2b7393f8711fbc354109daaa505e
MD5 hash: beb66745b7e64a76b54ec9ee0798f47e
humanhash: december-comet-winner-queen
File name:Golden Falcon Trading - Quote Product Lists.z
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:327'471 bytes
First seen:2020-05-10 07:51:13 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:XVx2nCd/leCQnVvaMVkGxlTwYLl0eM7ajhgOEEN3YMw811/:XynCnsFNVkGxltZCk2OEZMf
TLSH AA64239C1DEED9B796F3B4BB25C905407298D09B025F2B1831209187BABC5F42F5FE98
Reporter abuse_ch
Tags:RAT RemcosRAT z


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: cpb2.medionline.cl
Sending IP: 45.55.49.33
From: Ms. khatib nadia <admin@jenayllc.com>
Subject: Golden Falcon General Trading - Products Inquiry
Attachment: Golden Falcon Trading - Quote Product Lists.z (contains "Golden Falcon Trading - Quote Product Lists.exe")

RemcosRAT C2:
185.202.175.219:4110

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.45342.5326.3533.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-10 08:35:49 UTC
File Type:
Binary (Archive)
Extracted files:
49
AV detection:
18 of 48 (37.50%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=m7epjh6ohaqsgemnaumjf55mmofgz5tueow4bxfc3niu5hejwvya._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip 67c8f49fce382123118d051892f7ac638a6cf67423adc0dca2db514e9c89b570

(this sample)

RemcosRAT

Executable exe c01f7d088bbf081d5505e9356a6e1635eed13c9e8f8baef38f7a47c471067da2

  
Dropping
MD5 3844539eda5141cc6cfd0b3215a84822
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c01f7d088bbf081d5505e9356a6e1635eed13c9e8f8baef38f7a47c471067da2

Comments