MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a6d76984e3c80ef3ad3e2d9e6b4d8cd51f344e495cba16bb36899ea134597b52. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a6d76984e3c80ef3ad3e2d9e6b4d8cd51f344e495cba16bb36899ea134597b52
SHA3-384 hash: 3aadc6f23ea4299250601329fa2190d1856418034e2f7ad7a0f9717e95aa451b6e390c1dc873f1f24fbdb8ec0b9e19cf
SHA1 hash: bdd29ed015c0468007e5cbd867f8a68fa2ac3925
MD5 hash: 4c9c89bad0faac51b2dae4a2d707ee13
humanhash: florida-hotel-island-shade
File name:Gray_Sample_pictures001029D7FE46G.rar
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:253'689 bytes
First seen:2020-11-23 07:07:46 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:00nljalLTGjJkHtHEdeZ3dYrIijxySNOSwP3BUYRcP:/nlOlTGjJkSk4jgSNkP3C6cP
TLSH CC4423D07353CE270A989A6C810F4F16C8EBD4F5A491ADD9EA703A4EB7FCE51709D902
Reporter abuse_ch
Tags:rar RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: pro152-34.mxout.rediffmailpro.com
Sending IP: 119.252.152.34
From: merchant MauveO <m@mauveandolive.com>
Subject: Fw: PO for Marble Slabs
Attachment: Gray_Sample_pictures001029D7FE46G.rar (contains "Gray_Sample_pictures001029D7FE46G.exe")

RemcosRAT C2:
www.stellionlab.com:5004 (185.19.85.183)

Intelligence

File Origin
# of uploads :
1
# of downloads :
132
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a6d76984e3c80ef3ad3e2d9e6b4d8cd51f344e495cba16bb36899ea134597b52/
Threat name:
ByteCode-MSIL.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-11-23 07:08:06 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=u3lwtbhdzahphlj6fwpgwtmm2uptitsjls5bnozwrgpkcnczpnja._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/a6d76984e3c80ef3ad3e2d9e6b4d8cd51f344e495cba16bb36899ea134597b52

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar a6d76984e3c80ef3ad3e2d9e6b4d8cd51f344e495cba16bb36899ea134597b52

(this sample)

RemcosRAT

Executable exe 344ce3854299c58105065ee7c9605cb77d04669f433a6080f640fbe304c8e1df

  
Dropping
MD5 1b9a62412468d093dac7a6beb1aebcbd
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 344ce3854299c58105065ee7c9605cb77d04669f433a6080f640fbe304c8e1df

Comments