MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 edca0f767aa3bb8edc45173f7327b2cbcba81a63af65ebd83ea7be55f1327511. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: edca0f767aa3bb8edc45173f7327b2cbcba81a63af65ebd83ea7be55f1327511
SHA3-384 hash: a636fb65f7ec133fbcfa3a347aa20aca81a498f2d676bcc07a9373c399b1e3b2a3efdfa89072d7415112812199ef2b15
SHA1 hash: 3c2c3ea9c208de0416cb5ad200d8c55de12d586e
MD5 hash: 90cce8dfa569135c32652dfc5a514a78
humanhash: potato-nineteen-twenty-stream
File name:QUOTATION-PDF- SCAN COPY.r13
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:517'204 bytes
First seen:2021-02-08 14:42:10 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:biYbF/ds0L/2O9iowp7fCqBzEUvtPMzVlQ/oZEJo:nxu07ntwfF6lQE0o
TLSH BBB4231753F2D5880AAC39A8E4243973AF47B64B69720F74EAD51F3CA58E004917E6FC
Reporter abuse_ch
Tags:r13 RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: plesk05.diadem-tech.com
Sending IP: 103.227.62.65
From: pritam.dey@technoengineering.co.in
Subject: RE: Request for Quotation- /India
Attachment: QUOTATION-PDF- SCAN COPY.r13 (contains "QUOTATION-PDF- SCAN COPY.exe")

RemcosRAT C2:
eileenwmsscm.duckdns.org

Intelligence

File Origin
# of uploads :
1
# of downloads :
179
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/edca0f767aa3bb8edc45173f7327b2cbcba81a63af65ebd83ea7be55f1327511/
Threat name:
Win32.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-02-08 14:43:05 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5xfa65t2uo5y5xcfc47xgj5szpf2qgtdv5s6xwb6u67fl4jsouiq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/edca0f767aa3bb8edc45173f7327b2cbcba81a63af65ebd83ea7be55f1327511

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar edca0f767aa3bb8edc45173f7327b2cbcba81a63af65ebd83ea7be55f1327511

(this sample)

RemcosRAT

Executable exe 7c1e149c846e0453788be45dbad28de16018cbde56d0ffc712ac1d6db8abcb09

  
Dropping
MD5 57493b6abd6a579eb0614ba06755f77a
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7c1e149c846e0453788be45dbad28de16018cbde56d0ffc712ac1d6db8abcb09

Comments