MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9e31830230743fbd8374a2894cbbd4f10d2d91a4d08dde374d79aad92ceb247b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9e31830230743fbd8374a2894cbbd4f10d2d91a4d08dde374d79aad92ceb247b
SHA3-384 hash: 1edff0052438162aaf920cb4c109b337dac74507e024c734b5b0ef35e5c2ea43c56c0a8294062131dcc58ab38452a77a
SHA1 hash: fe42e68d9a98c8019f13c74e73200c1a61996140
MD5 hash: b08e045217a374f32b7b6de7866d1171
humanhash: uranus-autumn-october-three
File name:73a4f40d0affe5eea89174f8917bba73.gz
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:933'888 bytes
First seen:2021-02-17 06:32:00 UTC
Last seen:Never
File type: tar
MIME type:application/x-tar
ssdeep 24576:2oJZiJX4zzYYj4vj+2wcIzOaJrXbKymhetfnZDvno:zEeYA4vj5yX9uyWIw
TLSH 7215E09C717079EFC96BC2BADA686CA4EB3175BB930B8207921740B9591C9D7CF140B3
Reporter abuse_ch
Tags:gz RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: slot0.groveressentials.xyz
Sending IP: 203.159.80.67
From: Sales06 - PRO <order@groveressentials.xyz>
Subject: rfq/2021/FEB-017/QUOTATION 20210217 NEW ORDER (NEUE BESTELLUNG)
Attachment: 73a4f40d0affe5eea89174f8917bba73.gz (contains "73a4f40d0affe5eea89174f8917bba73.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
233
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Packed2.42845.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9e31830230743fbd8374a2894cbbd4f10d2d91a4d08dde374d79aad92ceb247b/
Threat name:
Win32.Trojan.Fonctuzim
Create hunting rule
Status:
Malicious
First seen:
2021-02-17 06:32:12 UTC
AV detection:
7 of 47 (14.89%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tyyygarqoq733a3uukeuzo6u6egs3ene2cg54n2npgvnslhler5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.38
Link:
https://yomi.yoroi.company/submissions/9e31830230743fbd8374a2894cbbd4f10d2d91a4d08dde374d79aad92ceb247b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

tar 9e31830230743fbd8374a2894cbbd4f10d2d91a4d08dde374d79aad92ceb247b

(this sample)

RemcosRAT

Executable exe 42ef2a340b9b5ec88d5ab83584f07ecc76e7b3842640aecd328ad9d85ad745e8

  
Dropping
MD5 1bf2f660917d980012006b0f8c152c31
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 42ef2a340b9b5ec88d5ab83584f07ecc76e7b3842640aecd328ad9d85ad745e8

Comments