MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eacc51ae6d599eb5e3894c531536fa367710a5d0afaa38e64e1a2dea02b2b496. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eacc51ae6d599eb5e3894c531536fa367710a5d0afaa38e64e1a2dea02b2b496
SHA3-384 hash: 69e92431cfa73b15de1a90f37ba952621077d8e26833769e22a7186291726c68d2fb89f2f5363433565b8c41eb2fffd6
SHA1 hash: 6bab8600474991b8d63d92761b70a4083b69db39
MD5 hash: 8dbbcbeda5b31e0081457dcb14928a0d
humanhash: single-nevada-sixteen-alabama
File name:RFQ-9911198765534112001001.IMG
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'966'080 bytes
First seen:2020-12-05 15:24:21 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:i5jEDerFYHpdkO/N6V/A3q3Is+Oiw2MioqoqoqoygCQCQCQC6060606FlTlzlzNw:i5gmF8tkYdGxC
TLSH E695B2FE7DED40EADC1E293E5C58B10C646E9EF4751448D10B2B78ABC5337A6ECA4809
Reporter abuse_ch
Tags:GoDaddy img RemcosRAT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: a2nlsmtp01-02.prod.iad2.secureserver.net
Sending IP: 198.71.225.36
From: Century Scientific & Equipment Co. WLL <notificaciones@sinergia-organizaciondeseguros.com>
Subject: RFQ-9911198765534112001-Century Scientific & Equipment Procurement
Attachment: RFQ-9911198765534112001001.IMG (contains "RFQ-9911198765534112001001.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
330
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs1133.UNOFFICIAL
Create hunting rule

Win.Dropper.Remcos-9802952-0
Create hunting rule

Result
Verdict:
SUSPICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eacc51ae6d599eb5e3894c531536fa367710a5d0afaa38e64e1a2dea02b2b496/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-12-05 06:31:24 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5lgfdltnlgplly4jjrjrknx2gz3rbjoqv6vdrzsodiw6uavswsla._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/eacc51ae6d599eb5e3894c531536fa367710a5d0afaa38e64e1a2dea02b2b496

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

img eacc51ae6d599eb5e3894c531536fa367710a5d0afaa38e64e1a2dea02b2b496

(this sample)

RemcosRAT

Executable exe f55cfbe0aee44bd68443ae34409da2a4932bf290e0e8b4d8af75f7989fcb33b3

  
Dropping
MD5 d24c02c90313b6b1c0557cfa15f99de9
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f55cfbe0aee44bd68443ae34409da2a4932bf290e0e8b4d8af75f7989fcb33b3

Comments