MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff8c7dd01b2ea97d43753512a36e8cbab7dd24e20af14f2e95b2c6483e899fbf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ff8c7dd01b2ea97d43753512a36e8cbab7dd24e20af14f2e95b2c6483e899fbf
SHA3-384 hash: b9ff1ca1c035e6cd5f850c99e5ae62e83009fe601ad219aa2ef2ba70453297aca2c1c5bbffb30f027ce22f938cbd40f8
SHA1 hash: 2c7fad7a0fd47d55610d8bd42eafc9606418621b
MD5 hash: 7c4bb08274fe6f8f78f964b50778ae2d
humanhash: enemy-vegan-early-emma
File name:SP AIR B00,pdf.zip
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:350'460 bytes
First seen:2021-02-09 10:05:25 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:jDH3RjO1GBN4fNSbTZVTqaV2PahMDGn0W71+ZNCVyj68L75QsCt3QoKeYjxPhu5:f3w1hN8VVTrV201n/YzCV+68LOCozY05
TLSH D57423FE45317C45B3E815A162AE5D68423A72F56D8512EC8FEF22602F00BDD9D7234B
Reporter abuse_ch
Tags:RAT RemcosRAT zip


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: cyberwave2.quape.com
Sending IP: 103.69.130.164
From: VESSEL Co., Inc. <info6.vessel.europe@vessel.co.jp>
Subject: Air Tools brand at competitive prices
Attachment: SP AIR B00,pdf.zip (contains "SP AIR B00,pdf.scr")

RemcosRAT C2:
zubby2468.hopto.org

Intelligence

File Origin
# of uploads :
1
# of downloads :
174
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_pdf.UNOFFICIAL
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Trojan.KillProc2.15070.31926.12760.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ff8c7dd01b2ea97d43753512a36e8cbab7dd24e20af14f2e95b2c6483e899fbf/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-08 19:39:46 UTC
AV detection:
21 of 47 (44.68%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=76gh3ua3f2ux2q3vgujkg3umxk352jhcblyu6luvwldeqpujt67q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ff8c7dd01b2ea97d43753512a36e8cbab7dd24e20af14f2e95b2c6483e899fbf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip ff8c7dd01b2ea97d43753512a36e8cbab7dd24e20af14f2e95b2c6483e899fbf

(this sample)

RemcosRAT

Executable exe 3a16a07b5af879c69e9e1225c0f5c6226fe505eff39d7a2195b1f9876fa804bf

  
Dropping
MD5 afc481d2bbf79310182759408a1b9b08
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3a16a07b5af879c69e9e1225c0f5c6226fe505eff39d7a2195b1f9876fa804bf

Comments