MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 90c1a3b51b8c4b00bbb8eaef1ac7677592c08d3b3f6edeeb32a45a4b3c902e51. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 7

Intelligence 7 IOCs YARA 6 File information Comments

SHA256 hash:	90c1a3b51b8c4b00bbb8eaef1ac7677592c08d3b3f6edeeb32a45a4b3c902e51
SHA3-384 hash:	34d1bad858ccd92d9b72d037f1845862689a7a8b1b9905aa27980c65b6a3dc1932d7740766844ca07954c1d09de44b8f
SHA1 hash:	175a351fa152b11ebc07005907da0b670bbd8838
MD5 hash:	8c11cdd82ea8e4881521ca1907854077
humanhash:	nine-sixteen-magnesium-glucose
File name:	018292540-LetterReguranPPI-20230814215304.PDF_5c2f175f-c5bd-4c69-b5ef-aaa6154f237b.gz
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	863'479 bytes
First seen:	2024-11-22 13:14:19 UTC
Last seen:	Never
File type:	gz
MIME type:	application/gzip
ssdeep	24576:nSCqNVuzqU+JOncEG7+FPIaVka5wxZ9xy:SbNVuzqj8cEGaFwc5wH9xy
TLSH	T1FC05337CAD69F863B802B717867F9660AED48538A9FE1B1ED115897C010CF8CED17AC4
Magika	gzip
Reporter	NDA0E
Tags:	FakePDF geo GRC gz RemcosRAT

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	018292540-LetterReguranPPI-20230814215304.PDF.exe
File size:	918'528 bytes
SHA256 hash:	3e080ccb41529931481861828df6a2ca32b039ed0217adcecb832547d8da0566
MD5 hash:	667060459d876845db2677ddc3d58488
MIME type:	application/x-dosexec
Signature	RemcosRAT

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Trojan.Siggen30.2837.9546.32195.UNOFFICIAL

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6740849bb31374f098337348

Tags:

keylog virus gates

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

masquerade packed packed packer_detected

Link:

https://www.filescan.io/uploads/674083d717cb31fee30bd2b7/reports/31f6f29b-08a8-40c9-8a4b-515aec216f34/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/90c1a3b51b8c4b00bbb8eaef1ac7677592c08d3b3f6edeeb32a45a4b3c902e51

Score:

100%

Verdict:

Malware

File Type:

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)