MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 73a130c2aa622f9e0e8387f994be1f5483186163c8dc59ad7528b8731da0f76b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 73a130c2aa622f9e0e8387f994be1f5483186163c8dc59ad7528b8731da0f76b
SHA3-384 hash: 4854c6d66e22f8702fceaa33f3aa164e1a28a110ba238193c86f881eb563711ad7c122460f287b4e7d62fc45511ee008
SHA1 hash: 4186ef3df2ca8b2ffdcb5e7f21b591e850dcdb9d
MD5 hash: 5188e4b809a59e016ce63fa995fa1c12
humanhash: happy-montana-lima-quiet
File name:INV77192732.IMG
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-06 08:22:17 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:vCXjmQqoL+mRHNFsTLWtJSMVddgjHm6rY:6qN+RPZm
TLSH 0545E0D9721172DFC887D832DDA82EA4AB65B47B831B8243B45F11AD9F4C997CF440E2
Reporter abuse_ch
Tags:img RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: cy.cybertechapi.live
Sending IP: 77.242.152.50
From: Daniel Hoban <daniel.hoban@allibhaimotors.com>
Subject: Confirm Copy of Invoice INV77192732
Attachment: INV77192732.IMG (contains "INV77192732.exe")

RemcosRAT C2:
pmanz.sytes.net:444 (172.93.189.93)

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.GenKryptik.EJYY.16356.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 08:35:45 UTC
File Type:
Binary (Archive)
AV detection:
15 of 31 (48.39%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ooqtbqvkmixz4dudq74zjpq7ksbrqyldzdoftllvfc4hghna65vq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

img 73a130c2aa622f9e0e8387f994be1f5483186163c8dc59ad7528b8731da0f76b

(this sample)

RemcosRAT

Executable exe a36c5afbe91c1e48ee0fff6a2a9f6c7840b9e89d529b40b1663cc442de5a346d

  
Dropping
MD5 8be8ddd48a46a9681edc78b4665b3cee
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a36c5afbe91c1e48ee0fff6a2a9f6c7840b9e89d529b40b1663cc442de5a346d

Comments