MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 90e7f0ef7f1af02408185c585feb51dc211ce16da0753896845b44c7d0c8449f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 90e7f0ef7f1af02408185c585feb51dc211ce16da0753896845b44c7d0c8449f
SHA3-384 hash: 5f6eb45cf2062183d2273d60cf750829c545e51fb66115969b09442ccbff3c231e35794618432b56f7e3ab92a4a43896
SHA1 hash: 336227b403a98b086f9ec5a51cde09f3487f5018
MD5 hash: 8662e197296c5c7144bd80f44e60dccb
humanhash: tango-crazy-skylark-november
File name:RFQ_1101983736366355 1101938377388.gz
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:334'238 bytes
First seen:2021-02-22 07:31:23 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:DlSK+VCIG2Mosnwm0IFd8PMJnU1zdW8KEBMSJ43z8VI9Pda/a1VREq0Nk3E0whVl:S+weFd8Eq7hilJda/mjHwB
TLSH B164232CB199C2CAC8D49D5BDC03C3C1B8E264ACD9327BD252F5274DA8B00ADDA75D0D
Reporter abuse_ch
Tags:gz Rackspace


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: smtp113.iad3a.emailsrvr.com
Sending IP: 173.203.187.113
From: The Gardens Restaurant <office@gardensrestaurantandcatering.com>
Reply-To: aabidah@gardensrestaurantandcatering.com
Subject: RFQ_1101983736366355 & 1101938377388-The Gardens Restaurant
Attachment: RFQ_1101983736366355 1101938377388.gz (contains "RFQ_1101983736366355 1101938377388.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
114
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/90e7f0ef7f1af02408185c585feb51dc211ce16da0753896845b44c7d0c8449f/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-02-22 07:32:15 UTC
AV detection:
14 of 46 (30.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sdt7b337dlycicaylrmf722r3qqrzylnub2trfuelncmpugiispq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

gz 90e7f0ef7f1af02408185c585feb51dc211ce16da0753896845b44c7d0c8449f

(this sample)

RemcosRAT

Executable exe 736c1c3ed4301b2f069ba84d5bcdf3919e88d5412fa13080d2eed53fe98c0ac4

  
Dropping
MD5 6e9180bce5c6bc68334ad9775ab22690
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 736c1c3ed4301b2f069ba84d5bcdf3919e88d5412fa13080d2eed53fe98c0ac4

Comments