MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ad223ee88137fa8c77dbe1ffd9364fd0e121c9d3a4416bee243035d8b5a72b0b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ad223ee88137fa8c77dbe1ffd9364fd0e121c9d3a4416bee243035d8b5a72b0b
SHA3-384 hash: 3823500cc286837f6bed8ebfe871145c7144b54452be8e4c197d34a109234d63b9af02844ef56a0cfc5c6eae4ef611f9
SHA1 hash: 80f21bfbde2cbf83ab89335ac4192fc4b8d58cca
MD5 hash: 306926fc270158b75346b5f7e1ab1181
humanhash: network-seven-robert-snake
File name:Purchase Order 26012021.rar
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:183'131 bytes
First seen:2021-02-01 09:56:32 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:Ch7EYj7cSP4uGFB2s+Bi9V7dlri8aMGjiRthcXIteUXfM19psRlmWH:Ch7dTP4Bt+0PDiWIXIteUv++H
TLSH 130412316C067EF81EEA5F00D9A945F69126880D0FF5F6B4C74697C8B2325AB406CE7C
Reporter abuse_ch
Tags:rar RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

From: "Gopi.GI" <goodkaroll@gmail.com>
Subject: Purchase Order: 26012021
Attachment: Purchase Order 26012021.rar (contains "dabsssss.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
117
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ad223ee88137fa8c77dbe1ffd9364fd0e121c9d3a4416bee243035d8b5a72b0b/
Threat name:
Win32.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2021-02-01 09:57:30 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vurd52ebg75iy5634h75snsp2dqsdsoturawx3rega25rnnhfmfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ad223ee88137fa8c77dbe1ffd9364fd0e121c9d3a4416bee243035d8b5a72b0b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar ad223ee88137fa8c77dbe1ffd9364fd0e121c9d3a4416bee243035d8b5a72b0b

(this sample)

RemcosRAT

Executable exe 585b90e0edb07e66ab99c6a2fdbd7190cb0cac755d8b1197ed8eb08fa82b359d

  
Dropping
MD5 e57f384410c68c6d4d8f2eef410519fa
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 585b90e0edb07e66ab99c6a2fdbd7190cb0cac755d8b1197ed8eb08fa82b359d

Comments