MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 af6ff8759891839ea8a8ecd2fcf0bd08736391da9d691ed4257eeca1fc0855e8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: af6ff8759891839ea8a8ecd2fcf0bd08736391da9d691ed4257eeca1fc0855e8
SHA3-384 hash: bb05ed0b3ec9c63c011ed15a179b1c5719d54fe07c1412b5e0ae7a3cbafb331a8381ac370b31ca96f70423fa5b6f9fdf
SHA1 hash: 419861e01f0023bd71ff79008b04b427467bf992
MD5 hash: deb1df90ea1234036c5faba245c2aa5c
humanhash: happy-may-ink-hotel
File name:BID_TENDER_DOCUMENTS-01.08.2020.rar
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:535'095 bytes
First seen:2021-01-08 08:22:01 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:V9r/azQCDixWBtpnncCfrMG4LoAv+nGYapSMw7jHvW5r3cqd5TV4C:b/KtBtlncCD94UG+GTpPUjHe5jcqd5TV
TLSH 2CB4234295F6978DC3E300646A50727BAF60B7673F06E347A6D0C2870E56F91CB6872B
Reporter abuse_ch
Tags:rar RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: srv.kibriswebhizmetleri.com
Sending IP: 213.159.5.123
From: Maria Simao <salesadmin@tommyadji.com>
Subject: Project Quotation Request
Attachment: BID_TENDER_DOCUMENTS-01.08.2020.rar (contains "BID_TENDER_DOCUMENTS-#01.08.2020.exe")

AgentTesla SMTP exfil server:
mail.cuulongcorp.com.vn:587

RemcosRAT C2:
212.83.46.26:4023

Intelligence

File Origin
# of uploads :
1
# of downloads :
132
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/af6ff8759891839ea8a8ecd2fcf0bd08736391da9d691ed4257eeca1fc0855e8/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-01-08 03:56:12 UTC
AV detection:
2 of 46 (4.35%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=v5x7q5mysgbz5kfi5tjpz4f5bbzwheo2tvur5vbfp3wkd7aikxua._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/af6ff8759891839ea8a8ecd2fcf0bd08736391da9d691ed4257eeca1fc0855e8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar af6ff8759891839ea8a8ecd2fcf0bd08736391da9d691ed4257eeca1fc0855e8

(this sample)

RemcosRAT

Executable exe 200c65040041056006600f5a6ed2bbc3281a6e440a12d24a84544d65e157288e

  
Dropping
MD5 1df1ba3f5339b6185d2588efb1d35859
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 200c65040041056006600f5a6ed2bbc3281a6e440a12d24a84544d65e157288e

Comments