MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e8ec51605bb6115691aa7e7e788f43fc2fed626bf479b22250e092a0481ccfb6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e8ec51605bb6115691aa7e7e788f43fc2fed626bf479b22250e092a0481ccfb6
SHA3-384 hash: babec094bc9ba576b351e0471c7f44d77c9e3af2f9a4b5f4835b309cc47dc652327f801519c5816e516f487b002aaf02
SHA1 hash: 5ca6cddc68efb49ca47ec59b49d09f5cdfb65702
MD5 hash: 1769b7646314d88c5876a1c81f4bcf03
humanhash: november-kitten-summer-pip
File name:POEA ADVISORY NO. 107.PDF.lzh
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:773'965 bytes
First seen:2020-09-02 06:11:01 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:U+y87s6jzMD0tzlVjgSQ5tJ/5Lt6nSW0sUBXdbmWHORidXvBIRiSgo5cEbw6vo:U+y87ptzXjOthxt6SDsUBnHLkFlE6vo
TLSH 45F42332F6E21365A8B8EB9370C44F46C137996377C14D3DC20B3629A4FB5B65B68362
Reporter abuse_ch
Tags:lzh RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: sd.latticesystems.com
Sending IP: 96.44.130.88
From: OPAP SECRETARIAT <opapsecretariat@yahoo.com>
Subject: POEA ADVISORY NO. 107
Attachment: POEA ADVISORY NO. 107.PDF.lzh (contains "POEA ADVISORY NO. 107.PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e8ec51605bb6115691aa7e7e788f43fc2fed626bf479b22250e092a0481ccfb6/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-09-02 05:36:34 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5dwfcyc3wyivnenkpz7hrd2d7qx62ytl6r43eisq4cjkasa4z63a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/e8ec51605bb6115691aa7e7e788f43fc2fed626bf479b22250e092a0481ccfb6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar e8ec51605bb6115691aa7e7e788f43fc2fed626bf479b22250e092a0481ccfb6

(this sample)

RemcosRAT

Executable exe 9ee1ed01fe26af330a114bc5d39fdfb3a6357a75b8091a234d115bf2230256c3

  
Dropping
MD5 29e8627b2373ead96fa20e5c7d492ae1
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9ee1ed01fe26af330a114bc5d39fdfb3a6357a75b8091a234d115bf2230256c3

Comments