MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a87f06752b982acba43a8e736c2a123148963197554714023085bbf9540666a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7a87f06752b982acba43a8e736c2a123148963197554714023085bbf9540666a
SHA3-384 hash: 536cf32fc8faf3827f6ea2acc7a8758d09726c547e472aea84fec4ca101d1474312fe6339feb957aad471ee70dfabca2
SHA1 hash: 4f18e91d98ba4f2273173757fcbf53dc8e8a3efa
MD5 hash: 9d31a177667c2f861a1fe9c6eaecc148
humanhash: pip-saturn-winter-black
File name:New Order.zip
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:556'115 bytes
First seen:2021-07-27 11:20:35 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:qi0Ni/I/Mg8lJaGjyub130YdIJTX7TWAbS2o7juHgayopQ:XESI/21pb1EII1TWAG2o7jsgTo6
TLSH T1E1C423D6C364FBBE2B369190EA868C4C04A9D59DFC39D2457B3E7265D38F74C208A139
Reporter cocaman
Tags:RemcosRAT zip


Avatar
cocaman
Malicious email (T1566.001)
From: "twinstravelegypt@gmail.com" (likely spoofed)
Received: "from gmail.com (unknown [185.222.58.116]) "
Date: "27 Jul 2021 03:06:44 -0700"
Subject: "Urgent Request For Quotation"
Attachment: "New Order.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
281
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.20634.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.22623.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/7a87f06752b982acba43a8e736c2a123148963197554714023085bbf9540666a
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Threat name:
Win32.Trojan.Zmutzy
Create hunting rule
Status:
Malicious
First seen:
2021-07-27 10:29:48 UTC
File Type:
Binary (Archive)
Extracted files:
19
AV detection:
8 of 46 (17.39%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pkd7az2sxgbkzosdvdttnqvbemkisyyzovkhcqbdbbn37fkamzva._file
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost rat
Link:
https://tria.ge/reports/210727-dylxvkbwwe/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Remcos
Malware Config
C2 Extraction:
45.137.22.101:5888
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.23
Link:
https://yomi.yoroi.company/submissions/7a87f06752b982acba43a8e736c2a123148963197554714023085bbf9540666a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip 7a87f06752b982acba43a8e736c2a123148963197554714023085bbf9540666a

(this sample)

RemcosRAT

Executable exe e69013a3a50ffb58b54a02e4317ad21da89fcadea6d92c0ba83fc1a10d0bb549

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e69013a3a50ffb58b54a02e4317ad21da89fcadea6d92c0ba83fc1a10d0bb549
  
Dropping
RemcosRAT

Comments