MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2345d711a060e0b47cfb8f182b608c1c6d49d80cd4fd7367ea19f9000497ec0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f2345d711a060e0b47cfb8f182b608c1c6d49d80cd4fd7367ea19f9000497ec0
SHA3-384 hash: 34bf9f7282ee89244bd1c84ab41f1b97ca2a2cf0c38c234216f1dd2687febcc52c6b1e82a458170c5be0f46bd3033202
SHA1 hash: 87200394fb9b4949a8275270d59322c81f3c2767
MD5 hash: d8d346be2407bc23ba49cff6c2a0068b
humanhash: whiskey-eighteen-juliet-coffee
File name:SIJ Metal 3.8.rar
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:282'208 bytes
First seen:2020-08-03 13:51:37 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:PmJyjcU+5BfhDqh75XUrC86NeqMfZjNOy1Fsz1+53NxBbtR:PfjcUcBpOtUrqNTMfZjNZeJ+JNTRR
TLSH D55423B491E84CBE4D277C806657FD07C8858D02AA564F433C51B24C9B7BAB2DE90C9F
Reporter abuse_ch
Tags:rar RemcosRAT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: vm4477.kronositalia.com
Sending IP: 95.174.19.18
From: Jelka Čas <jelka.cas@metaravne.com>
Reply-To: Jelka Čas <export.siamqrains@gmail.com>
Subject: Order - SIJ Metal Ravne
Attachment: SIJ Metal 3.8.rar (contains "SIJ Metal 3.8.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f2345d711a060e0b47cfb8f182b608c1c6d49d80cd4fd7367ea19f9000497ec0/
Threat name:
Win32.Trojan.Delf
Create hunting rule
Status:
Malicious
First seen:
2020-08-03 13:53:17 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6i2f24i2ayhawr6pxdyyfnqiyhdnjhmazvh5ont6ugpzaacjp3aa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f2345d711a060e0b47cfb8f182b608c1c6d49d80cd4fd7367ea19f9000497ec0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar f2345d711a060e0b47cfb8f182b608c1c6d49d80cd4fd7367ea19f9000497ec0

(this sample)

RemcosRAT

Executable exe eb1230ab4a5408a3d264bb51f1ff311fcf52aa97d52b801738cd5add365e77d2

  
Dropping
MD5 73d35243aaf0ae319e5aa7a478fadf5d
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 eb1230ab4a5408a3d264bb51f1ff311fcf52aa97d52b801738cd5add365e77d2

Comments