MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6b697589e7fd1b9a050866cafe258675b26b6b41bfb6e9bc1381b17ac0036613. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6b697589e7fd1b9a050866cafe258675b26b6b41bfb6e9bc1381b17ac0036613
SHA3-384 hash: 4e02435afb20faf52d1cacd5a2a5fea9f2387529fbeca768d054e7e06c2950cb9a587ac100c064b2bc18c7428de9a6ef
SHA1 hash: 01e27d99cbafda41c3272cd341929a219d47a8e8
MD5 hash: fd4cd835f539f2ef6ac0dcf1e14ee7cb
humanhash: ink-michigan-pip-violet
File name:statement-p.img
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:915'456 bytes
First seen:2020-08-18 11:44:46 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:VmgiOc2IWcsKjXATmyUJXyJ23pSAaJG2JBLiyuqt:VmgxvKTcmyUJCJ2QAaJGkF
TLSH A5155A42527C99DAF5ED6EB7A0610B198770CD5099BAA359D9CF78F0E8B3313CC861E0
Reporter abuse_ch
Tags:img RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: server1.englam.com.sg
Sending IP: 103.11.189.83
From: IRAS <tax@iras.com>
Subject: Corporate Income Return
Attachment: statement-p.img (contains "statement-p.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Score-7597125-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6b697589e7fd1b9a050866cafe258675b26b6b41bfb6e9bc1381b17ac0036613/
Threat name:
ByteCode-MSIL.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 05:59:32 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nnuxlcph7unzubiim3fp4jmgowzgw22bx63otpatqgyxvqadmyjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6b697589e7fd1b9a050866cafe258675b26b6b41bfb6e9bc1381b17ac0036613

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

img 6b697589e7fd1b9a050866cafe258675b26b6b41bfb6e9bc1381b17ac0036613

(this sample)

RemcosRAT

Executable exe b8d1d962744d0c6ab3abe293c4671b3ba6524f623f9d6f02361bc60eec7b4cb4

  
Dropping
MD5 a99d54543736ce9e6743db95d432aa62
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b8d1d962744d0c6ab3abe293c4671b3ba6524f623f9d6f02361bc60eec7b4cb4

Comments