MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 e4a5262b07dc0181293c892ed0ca8f71e1050340a5b3a9e4cd2fe24a0e06f0da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RemcosRAT
Vendor detections: 4
| SHA256 hash: | e4a5262b07dc0181293c892ed0ca8f71e1050340a5b3a9e4cd2fe24a0e06f0da |
|---|---|
| SHA3-384 hash: | 79998b517d7451f9bef99bc80a689a66ff9bc57b566223bf38c8cbe6b53fa26474abbe3d89a73b5131866fdc0d4698b9 |
| SHA1 hash: | d33ad254d094265369244bff8a6c1b52031fa623 |
| MD5 hash: | 1a1904355dd3f3e378576264d9a38f30 |
| humanhash: | blossom-green-yankee-item |
| File name: | P.O.No.17AUFR010S.pdf.7z |
| Download: | download sample |
| Signature | RemcosRAT |
| File size: | 495'681 bytes |
| First seen: | 2021-01-14 20:06:24 UTC |
| Last seen: | Never |
| File type: | 7z |
| MIME type: | application/x-rar |
| ssdeep | 12288:l8uobWi5dNz291VX7bl0hURYXmX5LaXvYcAQ6zefvlri40erLCanBM:iuTqdF291lWiR5XOcef/0ec |
| TLSH | E6B4230F8E6F6C8FE34DBBE7F2D025043660E64873462D4A2A7845354996F0C5B4BF1A |
| Reporter |  abuse_ch |
| Tags: | 7z nVpn RAT RemcosRAT |
abuse_ch
Malspam distributing RemcosRAT:HELO: zmta01.tradeindia.com
Sending IP: 14.140.162.138
From: info@medtechdevices.net
Subject: Re: Quote_New Order / P.O.No.#:17AUFR010S
Attachment: P.O.No.17AUFR010S.pdf.7z (contains "P.O.No.#17AUFR010S.pdf.exe")
RemcosRAT C2:
194.5.97.174:1990
Hosted on nVpn:
% Information related to '194.5.97.0 - 194.5.97.255'
% Abuse contact for '194.5.97.0 - 194.5.97.255' is 'abuse@privacyfirst.sh'
inetnum: 194.5.97.0 - 194.5.97.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-UK5
country: GB
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
mnt-by: PRIVACYFIRST-MNT
status: SUB-ALLOCATED PA
created: 2018-07-23T09:31:45Z
last-modified: 2020-08-26T17:48:55Z
source: RIPE
Intelligence
File Origin
# of uploads :
1
# of downloads :
164
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Threat name:
Win32.Trojan.Wacatac
Status:
Malicious
First seen:
2021-01-14 20:07:07 UTC
AV detection:
11 of 46 (23.91%)
Threat level:
5/5
Detection(s):
Malicious file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe Dropping
RemcosRAT
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.