MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f89cd5a3232228ff36f1a4d80641b4c48e617f0182985539ce3d818c64c294d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9f89cd5a3232228ff36f1a4d80641b4c48e617f0182985539ce3d818c64c294d
SHA3-384 hash: 5a353d9666b604dcaa14398d93ab3c6c95404e275897b6e8626c2b405c02eda740057aaece1dc6fd6da73e583453230a
SHA1 hash: e85ef18b3800253de8b6ce92cd69308912000e45
MD5 hash: 914c8297c5d255c9f5751c473b8b3368
humanhash: connecticut-leopard-pennsylvania-fruit
File name:Dragon Sourcing Co, Ltd - products inquiry list.z
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:271'214 bytes
First seen:2020-05-11 08:09:47 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:F1bpcaH4zSeWXHddSGqgwHHSHRxId9on8uiRUPgGgJ74grqEOzlfLYa:F1aU4zuXHddSGqgOyHDId96jTPgGgigw
TLSH F14423F36C3EC9B75AC980E08FD9CA2292DCEC8C41D7268B74444B1F663F544A6563E9
Reporter abuse_ch
Tags:RAT RemcosRAT z


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: cpb2.medionline.cl
Sending IP: 45.55.49.33
From: Dragon Sourcing Co, Ltd. <nihao@dragonsourcing.com>
Subject: Dragon Sourcing Co, Ltd - Products Inquiry from our clients.
Attachment: Dragon Sourcing Co, Ltd - products inquiry list.z (contains "Dragon Sourcing Co, Ltd - products inquiry list.exe")

RemcosRAT C2:
185.202.175.219:4110

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Avemaria
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 08:36:47 UTC
File Type:
Binary (Archive)
Extracted files:
50
AV detection:
21 of 45 (46.67%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=t6e42wrsgiri743pdjgyaza3jreomf7qdauyku444pmbrrsmffgq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

z 9f89cd5a3232228ff36f1a4d80641b4c48e617f0182985539ce3d818c64c294d

(this sample)

RemcosRAT

Executable exe bae8b4066339529707d17ae179702b89331df91afc355efd9b6b9f55fc1e2d09

  
Dropping
MD5 638b7aae95bbbb7ddcee0aa8d5ab64f4
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bae8b4066339529707d17ae179702b89331df91afc355efd9b6b9f55fc1e2d09

Comments