MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9bc1be7504ec4d743aca0e8722fc589fcd5d4124c4cd53998215d5320091541a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9bc1be7504ec4d743aca0e8722fc589fcd5d4124c4cd53998215d5320091541a
SHA3-384 hash: 8542ca4340eaf5aaed5c64f0535da29498556fec15edeef322399f725b362f86501466239bb72646f2a418a43f6041d9
SHA1 hash: a3b39c2cd9d9ea18b58fb20b7cc6414b6496abbf
MD5 hash: 7a07904981fbbcb9a652db3c41f06c3c
humanhash: equal-hydrogen-early-pip
File name:REMOUOOO9O9.7z
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:130'507 bytes
First seen:2020-12-30 09:31:11 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:QMjmjcly2fgDoMSBxcfjC8MzfqRLT+EaFZPG9UWc3kG:rmjclLfgDoDBmfjszfqRLZa7+UWKn
TLSH B4D3120CE8ED4CBD1BC9AC55F8A8C942EF02ABA7D2E7B4B41D593D0A33710D9216495F
Reporter abuse_ch
Tags:7z RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: hosted-by.rootlayer.net
Sending IP: 45.137.22.52
From: sales@alistekstil.com
Subject: PAYMENT INVOICE COPY
Attachment: REMOUOOO9O9.7z (contains "REMOUOOO9O9.exe")

RemcosRAT C2:
45.137.22.52:8780

Intelligence

File Origin
# of uploads :
1
# of downloads :
370
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9bc1be7504ec4d743aca0e8722fc589fcd5d4124c4cd53998215d5320091541a/
Threat name:
Win32.PUA.Wacapew
Create hunting rule
Status:
Malicious
First seen:
2020-12-30 09:32:05 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tpa345ie5rgxiowkb2dsf7cyt7gv2qjeytgvhgmccxkteaerkqna._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip 9bc1be7504ec4d743aca0e8722fc589fcd5d4124c4cd53998215d5320091541a

(this sample)

RemcosRAT

Executable exe 3ce969a94f4bc8dec526e3551626d7e3639bae986304deba85e8f29f039fe345

  
Dropping
MD5 3cb897ca05c3fd89587b17595d902ca8
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3ce969a94f4bc8dec526e3551626d7e3639bae986304deba85e8f29f039fe345

Comments