MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b5834c5958a278dd27068788692f56ed1289a14d5bbd2798e8c080cb613b8dc5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b5834c5958a278dd27068788692f56ed1289a14d5bbd2798e8c080cb613b8dc5
SHA3-384 hash: 27a511f58c071b94cbbc70cdab7d317652a2292b75fdedc5ce506adcb68f78c49842ac94f27f8ee29b24442156a9f468
SHA1 hash: 1afc1c0b8012b82fb11dcf0dfa5160d186a43b04
MD5 hash: b9cde56d74779a6fc59d3fe926f10f35
humanhash: london-stairway-cup-kilo
File name:Original BL, CI AWB.rar
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:63'035 bytes
First seen:2021-01-05 09:33:17 UTC
Last seen:2021-01-05 09:34:06 UTC
File type: rar
MIME type:application/x-rar
ssdeep 1536:5SNuFBrU3f1/nvCWV1+PWKr3DRrWbjy1cR:vrUvRXGWKjD+R
TLSH CE531224CC4FA7F6A2F29ED75E048819BCB1D78A24A172A837451CAA399E2D0F531D85
Reporter abuse_ch
Tags:rar RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: vps.jocmachinerys.com
Sending IP: 45.85.90.246
From: Maersk <support@bluehost.com>
Reply-To: swiftlogz@yandex.com
Subject: Re: URGENT 2021 MAERSK DELIVERY
Attachment: Original BL, CI AWB.rar (contains "Original BL_pdf.scr")

Intelligence

File Origin
# of uploads :
2
# of downloads :
228
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b5834c5958a278dd27068788692f56ed1289a14d5bbd2798e8c080cb613b8dc5/
Threat name:
Binary.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-01-05 09:34:06 UTC
AV detection:
3 of 46 (6.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wwbuywkyuj4n2jygq6egsl2w5ujitiknlo6spghiycamwyj3rxcq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b5834c5958a278dd27068788692f56ed1289a14d5bbd2798e8c080cb613b8dc5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar b5834c5958a278dd27068788692f56ed1289a14d5bbd2798e8c080cb613b8dc5

(this sample)

RemcosRAT

Executable exe 581bd1167bd9b40944de9a2d8842ed8aa841fdfc69d896c24520873095e0ac03

  
URLhaus
https://urlhaus.abuse.ch/url/949331/
  
Dropping
MD5 7fd79d1258fa8ed52e0d49bd780acd2e
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 581bd1167bd9b40944de9a2d8842ed8aa841fdfc69d896c24520873095e0ac03
  
Dropping
SHA256 dde6436d3e8a969f96e4ccec6904631d562efad960e0e9a6a2a865174750f3d6
  
Dropping
MD5 b58bb63ee0cc0210601eaec932b0f871

Comments