MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c7aa79f66a4bd631609ac30fafc2efeed62323a821e25b51381ca9c22ba8d490. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c7aa79f66a4bd631609ac30fafc2efeed62323a821e25b51381ca9c22ba8d490
SHA3-384 hash: 8425af414a9b0d3dee9690ad211de5eb3d93413a1eacbd24e3aaa6f237e23e58951d1aba232790c35fd1d65c830eb82a
SHA1 hash: 282079f47b41fef97af93fc93f3b6e8b511f4821
MD5 hash: 251baa75086e10f23163b57939df2bdf
humanhash: ceiling-harry-quiet-mexico
File name:QUOTATION_PDF SCAN _COPY.rar
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:524'310 bytes
First seen:2021-02-09 19:20:17 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:yu7af+X1x8YmFvPRtrpOexIrFMO/wwpsi59T:yPf42v33AZCdQ9T
TLSH 70B4232E70A31627F23AF5904E00C57B25BBEB0F994EAA5FE2DC027DD179D1D4348649
Reporter abuse_ch
Tags:rar RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: vps.ardepcare.com
Sending IP: 203.159.80.5
From: office@ardepcare.com
Subject: RE: Request for Quotation- / Spain
Attachment: QUOTATION_PDF SCAN _COPY.rar (contains "QUOTATION_PDF SCAN _COPY.exe")

RemcosRAT C2:
nikkihutsltd.duckdns.org

Intelligence

File Origin
# of uploads :
1
# of downloads :
116
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c7aa79f66a4bd631609ac30fafc2efeed62323a821e25b51381ca9c22ba8d490/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-08 21:07:57 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=y6vht5tkjpldcye2ymh27qxp53lcgi5iehrfwujydsu4ek5i2sia._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c7aa79f66a4bd631609ac30fafc2efeed62323a821e25b51381ca9c22ba8d490

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar c7aa79f66a4bd631609ac30fafc2efeed62323a821e25b51381ca9c22ba8d490

(this sample)

RemcosRAT

Executable exe 88cb48f7df1f0d18588de291df9a51242ad932823a4e73b2405954e4b0c2032e

  
Dropping
MD5 cb7270975bb196312173deccdd4fa6e6
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 88cb48f7df1f0d18588de291df9a51242ad932823a4e73b2405954e4b0c2032e

Comments