MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8858142380f173d5001f62408bbd6a58db25db8402e81ee953ab572afa19cbd6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8858142380f173d5001f62408bbd6a58db25db8402e81ee953ab572afa19cbd6
SHA3-384 hash: ba9bf36b2233420b8700f52fedbe6a2f3b44968297f2e2f14c3f3674bad3a963ae6ea5d4da1a8f37d6b700b91923bbe2
SHA1 hash: 7882d47eb5b386f5dd46cd50acbeda47ef31ad83
MD5 hash: 72db5f4820cf5e896da89ea1a0c25fa3
humanhash: december-echo-romeo-lithium
File name:Scan_order.r26
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:25'494 bytes
First seen:2021-01-11 07:07:11 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:EtnPD24yb5w8RyF0VQw8YfuZucd8Nyub3ZieMHvTwm:H4ylw8Ry0VuQiObJ7Mb
TLSH 20B2E1124435EBE936C81A4D9F6BAD35030A12ECD05C24E9AF673E41E730AF9609A9D3
Reporter abuse_ch
Tags:GuLoader r26 RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: slot0.jocmachinerys.com
Sending IP: 45.85.90.246
From: Wendy Cheng <info@daimler.com>
Reply-To: swiftlogz@yandex.com
Subject: RE: RE: REQUEST FOR YOUR COMPANY QUOTATION
Attachment: Scan_order.r26 (contains "Scan_order.scr")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1LZsqqMCLui4uAjpAqMIbGbmi-9F8VM3f

RemcosRAT C2:
wealthyblessed.myddns.rocks:52360 (185.157.161.61)

Intelligence

File Origin
# of uploads :
1
# of downloads :
125
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8858142380f173d5001f62408bbd6a58db25db8402e81ee953ab572afa19cbd6/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rbmbii4a6fz5kaa7mjaixplkldnslw4ealub52ktvnlsv6qzzpla._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8858142380f173d5001f62408bbd6a58db25db8402e81ee953ab572afa19cbd6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar 8858142380f173d5001f62408bbd6a58db25db8402e81ee953ab572afa19cbd6

(this sample)

RemcosRAT

Executable exe ab77af2c0fe4a39b3e2ec7b7450ef36999baf7c66316f4b3934d5a60e124d50c

  
URLhaus
https://urlhaus.abuse.ch/url/950966/
  
Dropping
MD5 04be7ed51e345a56403df4657b376990
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ab77af2c0fe4a39b3e2ec7b7450ef36999baf7c66316f4b3934d5a60e124d50c

Comments