MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7fc3cc71009fe5cc07ec9991020ed252b2588b69cfebc7ae5181e39c63073da0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	7fc3cc71009fe5cc07ec9991020ed252b2588b69cfebc7ae5181e39c63073da0
SHA3-384 hash:	637af888bf672150c0cbbc0585916f9a7ff695fa94283942a12dd587ce0998ae8f73e35e06dc1e1717fed098b068ca26
SHA1 hash:	fd7b8663ea0f6fa8bb8235751cf5cb6fdbb7feeb
MD5 hash:	f8648f41d4459440acbbb0c05eb5a77a
humanhash:	quiet-kansas-finch-green
File name:	Document 20240327_1188908_1188909.z
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	921'438 bytes
First seen:	2024-03-28 13:56:06 UTC
Last seen:	Never
File type:	z
MIME type:	application/x-rar
ssdeep	24576:XyzsCL9b7s++GW18y/1hmUsCBH+DCNiUuCm:XyzHbY+U18y/1hWweDCNECm
TLSH	T1241533015FE4DA210ED0E1FC57C96AD170CDB7A18AFD823E4C4D64FB5891A988E17E8A
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	payment RemcosRAT z

cocaman

Malicious email (T1566.001)
From: "ZHANG Rui <szhangrui@stengg.com>" (likely spoofed)
Received: "from mail.arxtorn.com (mail.arxtorn.com [79.141.163.180]) "
Date: "28 Mar 2024 04:44:43 -0700"
Subject: "Outstanding Payment"
Attachment: "Document 20240327_1188908_1188909.z"

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

95

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Document 20240327_1188908_1188909.bat
File size:	3'500'311 bytes
SHA256 hash:	f2983bae21d56a3081e78ebdfe8c91b007a0e7e3b363850fb48ee90eeea953df
MD5 hash:	d7fa42ada80342b77afe8fc6d8a3b454
MIME type:	text/plain
Signature	RemcosRAT

Vendor Threat Intelligence

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

extrac32 lolbin

Link:

https://www.filescan.io/uploads/6605773476a204da5db45d7b/reports/7a35aef3-fa6e-42a7-b635-05c682f176a8/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/7fc3cc71009fe5cc07ec9991020ed252b2588b69cfebc7ae5181e39c63073da0

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7fc3cc71009fe5cc07ec9991020ed252b2588b69cfebc7ae5181e39c63073da0/

ReversingLabs TitaniumCloud Binary.Trojan.Pantera

Threat name:

Binary.Trojan.Pantera

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-03-28 07:18:53 UTC

File Type:

Binary (Archive)

Extracted files:

3

AV detection:

6 of 24 (25.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=p7b4y4iat7s4yb7mtgiqedwskkzfrc3jz7v4plsrqhrzyyyhhwqa._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7fc3cc71009fe5cc07ec9991020ed252b2588b69cfebc7ae5181e39c63073da0