MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 76a58eac1cf081fb20ffcf5370c95e3daf85c9325b6796ca64b308fd474fa8e3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 76a58eac1cf081fb20ffcf5370c95e3daf85c9325b6796ca64b308fd474fa8e3
SHA3-384 hash: de7a1589858d76104be53a325cb4340a36003f13e24b337d823b3e19535017179afe455151f2501214aac6c4c7dbbe70
SHA1 hash: c13b92a6eef1ec5b644eb94c5e69b38a7dd6ff23
MD5 hash: ddf6a6bbab66b9b7109db19eda8bfc9a
humanhash: island-network-pluto-idaho
File name:Musalli Factory - products lists.z
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:374'916 bytes
First seen:2020-05-03 07:47:19 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:On3O9t3rfZcqtCHyL0HoNBdSlRnMT4Hm/t0davT4Pu1q:O+9t3lPe9HoN/gnq4AtK3H
TLSH 2F8423AA5D29FDC3491DAC9D30DD84BFB11BA7A33526D92318C1C160778BB49E723928
Reporter abuse_ch
Tags:RAT RemcosRAT z


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: cpb2.medionline.cl
Sending IP: 45.55.49.33
From: ALOZZA FAHIMA <info@musallifactory.com>
Subject: Musalli Factory & Trading Co. - Urgent Products Inquiry
Attachment: Musalli Factory - products lists.z (contains "Musalli Factory - products lists.exe")

RemcosRAT C2:
212.83.46.23:3110

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-03 08:35:39 UTC
File Type:
Binary (Archive)
Extracted files:
19
AV detection:
20 of 48 (41.67%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=o2sy5la46ca7wih7z5jxbsk6hwxylsjslntznstewmep2r2pvdrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

z 76a58eac1cf081fb20ffcf5370c95e3daf85c9325b6796ca64b308fd474fa8e3

(this sample)

RemcosRAT

Executable exe 916c72039c2b0952ffee4330d20b0dc43450639e3299ceea3c7165d23386a339

  
Dropping
MD5 bc6bfe1fdbac5f0330e54aab7786c471
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 916c72039c2b0952ffee4330d20b0dc43450639e3299ceea3c7165d23386a339

Comments