MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 98ae0a2036cfeaccf8af49318171bb5aab03b459f25342a316517c3700e118ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 98ae0a2036cfeaccf8af49318171bb5aab03b459f25342a316517c3700e118ea
SHA3-384 hash: edaa89c66bb294d711dc232035757b719ff8bb527ef8cff748d68132280474fa6d98ebfe0f8dd949ae66982d8f0b83c4
SHA1 hash: 6158b5159eddc7b6ff150fbf7035ec4042a7d47c
MD5 hash: 8e46fa0eda3d31bc39bb6c2034009a3f
humanhash: seventeen-emma-angel-carbon
File name:PDF_ADJUNTO_613615401883763997495709975568_09982616226275914808755066_9325247141959196491528328396_5
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:329'777 bytes
First seen:2020-08-13 07:43:37 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:bMGj4DS+XuRlENCTT7lQXq3z7o/wFM1lm2NGO6MiXrP:bMGj4DSau3Eo708IAMianViz
TLSH 516423C534EBB212A869E990B7D86F7D8E2CA1CA074503A904449C47FD48A43BFB55FF
Reporter abuse_ch
Tags:Outlook RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: NAM12-BN8-obe.outbound.protection.outlook.com
Sending IP: 40.92.21.15
From: info. Extracto <electromacltda51@outlook.es>
Subject: EXTRACTO SERFINANZA.
Attachment: PDF_ADJUNTO_613615401883763997495709975568_09982616226275914808755066_9325247141959196491528328396_5 (contains "PDF_ADJUNTO_613615401883763997495709975568_09982616226275914808755066_9325247141959196491528328396_5724162511852732_pdf.exe")

RemcosRAT C2:
recuperaciondecartera.website:6790

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/98ae0a2036cfeaccf8af49318171bb5aab03b459f25342a316517c3700e118ea/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-08-13 07:45:05 UTC
AV detection:
3 of 48 (6.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tcxauibwz7vmz6fpjeyyc4n3lkvqhncz6jjufiywkf6doahbddva._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/98ae0a2036cfeaccf8af49318171bb5aab03b459f25342a316517c3700e118ea

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar 98ae0a2036cfeaccf8af49318171bb5aab03b459f25342a316517c3700e118ea

(this sample)

RemcosRAT

Executable exe 01725ebec49d4d44baf1ef214ac4475f7a2d13b284eaa756e41eb2fba4093d5e

  
Dropping
MD5 9ea6f12332890b68bc782bdc6edf56f8
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 01725ebec49d4d44baf1ef214ac4475f7a2d13b284eaa756e41eb2fba4093d5e

Comments