MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 70af6595ace0e87b1ae46a9a453337c1f6bcb19557aa80f338ad068690f9ceec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 70af6595ace0e87b1ae46a9a453337c1f6bcb19557aa80f338ad068690f9ceec
SHA3-384 hash: 16e3380793e01a0ad4095fec8c6c84b14090118f2a70bb21acd2b2a2f057957d90538365c42c0ea527a305ba7e60f3f0
SHA1 hash: 1d5404ab8d974ee1664d53b4f2373b093cf97ded
MD5 hash: c4c36af96386391df8bca34a3bf5ed38
humanhash: virginia-missouri-timing-hot
File name:RECEIPT-IMG303948485.gz
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:598'196 bytes
First seen:2022-02-08 10:01:07 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:Fp1YWx2nN6+bsOQUoJ2OkdsaNP3PxyJMrp6y6gQ3WnXh8ibRHLYzXnh2:X1gZXMwsaVfxuZy5QKZlHUrn4
TLSH T167D423B58E9DC03C8B9250D549182AD5E3F85206D1E264DA1CEEF16CE4A4B9C9CEF2F4
Reporter DFNCERT
Tags:gz RAT remcos

Intelligence

File Origin
# of uploads :
1
# of downloads :
167
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.22869.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.22876.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/70af6595ace0e87b1ae46a9a453337c1f6bcb19557aa80f338ad068690f9ceec/
Threat name:
Binary.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-02-08 01:37:47 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
3 of 27 (11.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ocxwlfnm4duhwgxenknekmzxyh3lzmmvk6vib4zyvudinehzz3wa._file
Gathering data
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/70af6595ace0e87b1ae46a9a453337c1f6bcb19557aa80f338ad068690f9ceec

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

gz 70af6595ace0e87b1ae46a9a453337c1f6bcb19557aa80f338ad068690f9ceec

(this sample)

RemcosRAT

Executable exe 37c7e817c4e65f4737e54b6f0801be11682cbcccab5e7bdd7d75deee904866cd

RemcosRAT

zip 462432376eddb58976b2e37d005fa536e8289e0f1224f0292b2fc748f6e70691

  
Dropping
SHA256 462432376eddb58976b2e37d005fa536e8289e0f1224f0292b2fc748f6e70691
  
Delivery method
Distributed via e-mail attachment

Comments