MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a8309bc3b0c1cc0adc017f3159842352f12de2e412a3d40d72f5a7797b0d5aed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a8309bc3b0c1cc0adc017f3159842352f12de2e412a3d40d72f5a7797b0d5aed
SHA3-384 hash: fc593606558524e9bad3566017d1df95c49ec1066ace25549f01cf470eda925e8529536d534a6a9103fa1e085561c198
SHA1 hash: 3e8925bb1bd4f70cd7db0f59663b8d11db47a332
MD5 hash: 63249c3fd06b2d6252dee3a7038b4e53
humanhash: lemon-enemy-potato-neptune
File name:Order.img
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'245'184 bytes
First seen:2021-01-14 06:58:21 UTC
Last seen:2021-01-14 07:38:01 UTC
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:KFj3DIHOmOmAO9YANckwXZtBHqREyAGCfEXllXDmnt:KJ3IfRyp7HSEyAGC8XLXc
TLSH 544508DE12F1006BD12945B4A959EFE05560FC787B61C226BE84FCCEAF723E054622F6
Reporter abuse_ch
Tags:Hostwinds img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: hwsrv-824517.hostwindsdns.com
Sending IP: 23.238.43.35
From: imports@welfare.top
Subject: Request For Quotation And Price Listing
Attachment: Order.img (contains "ORDER 33.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
119
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Strictor.105210.31358.29752.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a8309bc3b0c1cc0adc017f3159842352f12de2e412a3d40d72f5a7797b0d5aed/
Threat name:
Win32.Trojan.Strictor
Create hunting rule
Status:
Malicious
First seen:
2021-01-14 06:59:06 UTC
AV detection:
13 of 44 (29.55%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vayjxq5qyhgavxabp4yvtbbdklys3yxeckr5idls6wtxs6ynllwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a8309bc3b0c1cc0adc017f3159842352f12de2e412a3d40d72f5a7797b0d5aed

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

img a8309bc3b0c1cc0adc017f3159842352f12de2e412a3d40d72f5a7797b0d5aed

(this sample)

RemcosRAT

Executable exe 4c73230621e55c51c6e4a32e354dca5e8fd3aaaa2df450b73991e6e21257a742

  
Dropping
MD5 093f7881caf5cb7a06058de4f4678590
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4c73230621e55c51c6e4a32e354dca5e8fd3aaaa2df450b73991e6e21257a742

Comments