MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9782c082b22d6fbb6c4b1b8fdfa05ddedffc1002d6ab4c7180a10595b9d92068. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9782c082b22d6fbb6c4b1b8fdfa05ddedffc1002d6ab4c7180a10595b9d92068
SHA3-384 hash: f40f8994865043ac96f27cea3c783e7dc57aac085ca7e74a3fcf03bd1725ea81fe9808d92e10c115fa9504472eeef213
SHA1 hash: 685e1ab1c713e4fbe84edab9dccf827ff4a64f36
MD5 hash: fbd550d956ec6d394450498065bc28f8
humanhash: burger-freddie-kilo-network
File name:Quotation.rar
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:300'867 bytes
First seen:2021-02-01 09:56:37 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:tyT22HoSrVzbHmDr0r8CdSNBXav4IHOflgCog:8T26oOHm30IUSNBqDOfnog
TLSH 615423369275971ED41D877C27C8F47EAE6D88ED48CC774D3818FA39EE3A5858481A30
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mx.pec.aruba.it
Sending IP: 95.110.216.96
From: Jonny<office@ardepcare.com>
Subject: RE: Request for Quotation
Attachment: Quotation.rar (contains "Quotation.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
113
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9782c082b22d6fbb6c4b1b8fdfa05ddedffc1002d6ab4c7180a10595b9d92068/
Threat name:
Win32.Trojan.Remcos
Create hunting rule
Status:
Malicious
First seen:
2021-02-01 09:57:32 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=s6bmbavsfvx3w3cldoh57ic533p7yeac22vuy4maueczloozebua._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9782c082b22d6fbb6c4b1b8fdfa05ddedffc1002d6ab4c7180a10595b9d92068

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar 9782c082b22d6fbb6c4b1b8fdfa05ddedffc1002d6ab4c7180a10595b9d92068

(this sample)

RemcosRAT

Executable exe 1e0aa65ef76cde02b030850f1895a64fbe866b948f5f29ce7b2d6f9e064b4f84

  
Dropping
MD5 5b4309d7aabb8ca44a4aa15ab49ea964
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1e0aa65ef76cde02b030850f1895a64fbe866b948f5f29ce7b2d6f9e064b4f84

Comments