MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d5fe32fe3d6d5ffbc269fc7ba1291b2caef7c188c61ef051c79fe29fb6bb00cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d5fe32fe3d6d5ffbc269fc7ba1291b2caef7c188c61ef051c79fe29fb6bb00cb
SHA3-384 hash: 1bec490802f71c942c1dcac6c2bf4661f271701c444548e612f8c1d976a8ee5cb6045f67ce9df716c4d0cc5934f913fe
SHA1 hash: 7d2216e456bedb7ab01bd2a0b432f9f4d40b2455
MD5 hash: 22fdc2850fd2b37a5f07bd8e27e84815
humanhash: beer-moon-jersey-twenty
File name:QUOTATION.gz
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:574'486 bytes
First seen:2020-10-22 07:03:14 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:QY8LA4Kycmnw+9xcZricaaenyZqSFQv4eAg87e1TfsGwKINER6Hc7s4Iu:en59xcZri5aeylFmzQ+TkiRR6Is4T
TLSH 28C423784827160F958FC2524105EF4A85CBBC9AAF2AF6A48ECC5D99781E6DD30F3D4C
Reporter abuse_ch
Tags:gz RemcosRAT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: yandex.com
Sending IP: 37.49.225.133
From: stoneadamss@yandex.com
Subject: QUOTATION
Attachment: QUOTATION.gz (contains "QUOTATION.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d5fe32fe3d6d5ffbc269fc7ba1291b2caef7c188c61ef051c79fe29fb6bb00cb/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-10-22 06:45:34 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2x7df7r5nvp7xqtj7r52cki3fsxppqmiyyppauoht7rj7nv3adfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

gz d5fe32fe3d6d5ffbc269fc7ba1291b2caef7c188c61ef051c79fe29fb6bb00cb

(this sample)

RemcosRAT

Executable exe 344e6fbb3b331ae13507bca32206ceea89837dc6c02eeadeeee979d8312199b6

  
Dropping
MD5 4bbd44a23aeac32652aed1b899af8d3b
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 344e6fbb3b331ae13507bca32206ceea89837dc6c02eeadeeee979d8312199b6

Comments