MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a7f33a24ee55565a86a40e567d40441e2600ec80380b5bfe96ed88bdcfcaac70. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a7f33a24ee55565a86a40e567d40441e2600ec80380b5bfe96ed88bdcfcaac70
SHA3-384 hash: 1e12026ca724615d7d648cb5642087917fbdd00f5034385368096ca810193a069421ef644c5d6afd4b37e2ce8a113d9f
SHA1 hash: 4e311090d58678db23399cc05dc9a9ed3d682d51
MD5 hash: 01e7ee706159293af9475b6b2700234a
humanhash: yellow-butter-tennis-nebraska
File name:MV CHEN GLORY 1 Q88.xz
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:340'416 bytes
First seen:2021-02-16 14:18:33 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:UQRAVg0gPgYaqZ1YPibmP8sp2GgVE/pTaFzZmJGiCTu+/aMqmlEydZw4m0kNUILZ:UgPgXPwkpICabs+/aMqUe4wUmZ
TLSH B174233E374D743D04BFA0A59E46259B66439AF0DA832F0B8799AD94CF0BDC3C246B05
Reporter abuse_ch
Tags:HostGator RAT RemcosRAT xz


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: gateway30.websitewelcome.com
Sending IP: 192.185.152.11
From: Ca-Marine Co.Ltd <camarinesnp@gmail.com>
Subject: FOR SALE: MV CHEN GLORY 1 / BOX/SID GC / 12,6K DWT / BLT 98 CHN
Attachment: MV CHEN GLORY 1 Q88.xz (contains "MV CHEN GLORY 1 Q88.DOC.exe")

RemcosRAT C2:
chx-ch.ddns.net:6855 (207.32.217.11)

Intelligence

File Origin
# of uploads :
1
# of downloads :
248
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_doc.UNOFFICIAL
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.25805.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a7f33a24ee55565a86a40e567d40441e2600ec80380b5bfe96ed88bdcfcaac70/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-02-16 14:19:06 UTC
AV detection:
23 of 47 (48.94%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=u7ztujhokvlfvbvebzlh2qcedytab3eahafvx7uw5wel3t6kvrya._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a7f33a24ee55565a86a40e567d40441e2600ec80380b5bfe96ed88bdcfcaac70

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip a7f33a24ee55565a86a40e567d40441e2600ec80380b5bfe96ed88bdcfcaac70

(this sample)

RemcosRAT

Executable exe cbf5b54d5d1c70086efefea16f38b80a329cb96bb5a59e709b0ab2304acb157c

  
Dropping
MD5 23f61dde4507b23de8228b969a9f363c
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cbf5b54d5d1c70086efefea16f38b80a329cb96bb5a59e709b0ab2304acb157c

Comments