MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1c5b83c0fb8f08951933a43891fb91a3a1683a7860e75ca909f1ad257cea8ad6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1c5b83c0fb8f08951933a43891fb91a3a1683a7860e75ca909f1ad257cea8ad6
SHA3-384 hash: 9e9106b0a93cb05914739ddee4dfb272dc2bd9419bdf4ce37f5f8f9b0ea25efe8b91de93f48d99d99134777d0fcf0904
SHA1 hash: 3c0d8afcf9a8bbf23c3e153d30f91b7974128a97
MD5 hash: 3b80212baa72cf0043f223fecc0f3f7f
humanhash: victor-video-wolfram-robert
File name:Cobro Juridico_05579370286563_03394107_8493307707954183112988_2837990089_4928917099750693932_7167657
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:229'785 bytes
First seen:2020-07-29 06:34:26 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:vFk/9Gkx+IVmgjHDwD9C+ELe5j3Hd5E0cFTh3qNua:Nk/n8IVD+5l53HaFTh3y
TLSH E0242367760EABFED2D6249DB0B29F1150836D97C0B13377120D76F9BA323D9610A718
Reporter abuse_ch
Tags:Outlook


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: NAM04-SN1-obe.outbound.protection.outlook.com
Sending IP: 40.92.11.61
From: Nelly Moscoso Martinez <pao-alejo-sebas@hotmail.com>
Subject: COBRO JURIDICO SERFINANZA.
Attachment: Cobro Juridico_05579370286563_03394107_8493307707954183112988_2837990089_4928917099750693932_7167657 (contains "Cobro Juridico_05579370286563_03394107_8493307707954183112988_2837990089_4928917099750693932_71676575_673532931113_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1c5b83c0fb8f08951933a43891fb91a3a1683a7860e75ca909f1ad257cea8ad6/
Threat name:
ByteCode-MSIL.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 06:36:07 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=drnyhqh3r4ejkgjtuq4jd64ruoqwqotymdtvzkij6gwsk7hkrlla._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1c5b83c0fb8f08951933a43891fb91a3a1683a7860e75ca909f1ad257cea8ad6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar 1c5b83c0fb8f08951933a43891fb91a3a1683a7860e75ca909f1ad257cea8ad6

(this sample)

RemcosRAT

Executable exe adbc3dc51f95c015745ba340922b17b59d4528b206871c158f7b6f453f8af972

  
Dropping
MD5 22196267d54c4685ae99add9eae72c85
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 adbc3dc51f95c015745ba340922b17b59d4528b206871c158f7b6f453f8af972

Comments