MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f93ff823cce84c4301ee3fe1fd97695ff357e3a442dce2805c87b44555bb5a83. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f93ff823cce84c4301ee3fe1fd97695ff357e3a442dce2805c87b44555bb5a83
SHA3-384 hash: ff903d3a1a0209744d9af727625c620ffaf55e3d4af4d25efd7c425bfcb7188a77e04706d5068af02658eba8d414f0e7
SHA1 hash: d78b5ecbf121c26aec0f8941038b1968f47d8dc7
MD5 hash: a17290406cd350b20c5d66114e6e3fe2
humanhash: early-july-carbon-butter
File name:file.zip
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:793'088 bytes
First seen:2021-01-31 07:44:44 UTC
Last seen:Never
File type:unknown
MIME type:application/x-tar
ssdeep 12288:6R7lwNJr9ewyiazSLOWqGd0IuNEExaOzoBmI1t5oBXkl/2eQB/W2nbSoyTLgXsq6:S76M53GpuNEQaO0J6B0l0WKeoyTL
TLSH 88F4129833687BDFC87BD8B09D681C74E560B9BE931B475B910B0599EA0F58BCF041E2
Reporter abuse_ch
Tags:RAT RemcosRAT zip


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: slot0.groveressentials.xyz
Sending IP: 203.159.80.67
From: Sales2- Order <order@groveressentials.xyz>
Subject: rfq/2020/QUOTATION 20200130 NEW ORDER
Attachment: file.zip (contains "84ab43f7eda35ae038b199d3a3586b77.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
202
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f93ff823cce84c4301ee3fe1fd97695ff357e3a442dce2805c87b44555bb5a83/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-31 07:45:14 UTC
AV detection:
14 of 46 (30.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7e77qi6m5bgegapoh7q73f3jl7zvpy5eiloofac4q62ekvn3lkbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.75
Link:
https://yomi.yoroi.company/submissions/f93ff823cce84c4301ee3fe1fd97695ff357e3a442dce2805c87b44555bb5a83

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

unknown f93ff823cce84c4301ee3fe1fd97695ff357e3a442dce2805c87b44555bb5a83

(this sample)

RemcosRAT

Executable exe 65796dbe5e0bc0d3108d244d9c9721bd8403c6101dc05a2b9aab513f69afebaa

  
Dropping
MD5 5182fffc0daa2c8835042bc1794a3a91
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 65796dbe5e0bc0d3108d244d9c9721bd8403c6101dc05a2b9aab513f69afebaa

Comments