MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c81928e99a9e7d07ab12cb55e97c5f60a0d8ef7e335c13b256d2e5ecaa3540e7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c81928e99a9e7d07ab12cb55e97c5f60a0d8ef7e335c13b256d2e5ecaa3540e7
SHA3-384 hash: 6a1f5a5797fff6a7ff2ce3e17cd18ee18092bf37484391452e50789bc04099125a90013ef90216adc20b8406949b3128
SHA1 hash: 9d5e7d52cce4122830093f157668af213e726e1e
MD5 hash: cb9b427790838c5a9c8b997cc1c2a7a4
humanhash: jupiter-mississippi-coffee-quebec
File name:Quotation Request.rar
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:540'130 bytes
First seen:2021-02-09 18:54:03 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:B0suQ088pY7L+qu4un9tcCLUeXj6ZR9amgGn+VDHqYsjlmKC:Bdt8maqu4AncwUiG7CGnUMBmL
TLSH 83B4232AC9EDC1679589E8940AFD3DD242530737D94249C1BA9CECFE50C0391AF9E93D
Reporter abuse_ch
Tags:rar RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: vps.ardepcare.com
Sending IP: 203.159.80.5
From: office@ardepcare.com
Subject: Introduction/ Quotation Request (6092020)
Attachment: Quotation Request.rar (contains "Quotation Request.exe")

RemcosRAT C2:
camrow1.duckdns.org

Intelligence

File Origin
# of uploads :
1
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c81928e99a9e7d07ab12cb55e97c5f60a0d8ef7e335c13b256d2e5ecaa3540e7/
Threat name:
Win32.Trojan.Tiggre
Create hunting rule
Status:
Malicious
First seen:
2021-02-08 17:48:00 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zamsr2m2tz6qpkysznk6s7c7mcqnr336gnobhmsw2ls6zkrvidtq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c81928e99a9e7d07ab12cb55e97c5f60a0d8ef7e335c13b256d2e5ecaa3540e7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar c81928e99a9e7d07ab12cb55e97c5f60a0d8ef7e335c13b256d2e5ecaa3540e7

(this sample)

RemcosRAT

Executable exe 334c66095834799531fed4e977171a3164050c285f943b4433c45820c9038cca

  
Dropping
MD5 c638cfca0f2e65646cde172eef53a394
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 334c66095834799531fed4e977171a3164050c285f943b4433c45820c9038cca

Comments