MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f9885b704de7e7af77423e2130f749661abf41d109c774ff5a47db0cfd07c3d4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f9885b704de7e7af77423e2130f749661abf41d109c774ff5a47db0cfd07c3d4
SHA3-384 hash: b659a5561b5f9097ee152ec1dba798a474505180372d61fdb499e2df56f9d32824d7cc4a7b8e82e8dd57cb3380dbbaec
SHA1 hash: 95fe5e421ec61deb173d9a72fdcb733e2d8558eb
MD5 hash: 18af0a733a2047d3ab5cf40a3d2c5ced
humanhash: red-seven-kentucky-coffee
File name:Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_707
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:312'763 bytes
First seen:2020-08-05 08:46:33 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:Prjnj8DSZP6rvH/j4aba/f8kCguQJWi7DEW5B+oGdmkydqJDHzzMZ:Pfj8M6rvfj4aba/fkguQIuz27dmXkxHc
TLSH 9664235847E861E32C41DCBD1612E227449DC3F09C42DD89EF9BB1CEF62E59681CB89B
Reporter abuse_ch
Tags:Outlook RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: NAM02-CY1-obe.outbound.protection.outlook.com
Sending IP: 40.92.4.48
From: willington alejandro gonzales bravo <alejito-gonzales@hotmail.com>
Subject: COBRO JURIDICO SERFINANZA.
Attachment: Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_707 (contains "Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe")

RemcosRAT C2:
recuperaciondecartera.website:6790 (186.169.76.50)

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f9885b704de7e7af77423e2130f749661abf41d109c774ff5a47db0cfd07c3d4/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 08:48:07 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7gefw4cn47t2652chyqtb52jmynl6qorbhdxj722i7nqz7ihypka._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f9885b704de7e7af77423e2130f749661abf41d109c774ff5a47db0cfd07c3d4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar f9885b704de7e7af77423e2130f749661abf41d109c774ff5a47db0cfd07c3d4

(this sample)

RemcosRAT

Executable exe 417022af236bc97978cd14c5ffb8e5ced3392987a8b73ae3a5f1906367419abd

  
Dropping
MD5 4b665d364bee62dc7c1f74e93b0d660b
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 417022af236bc97978cd14c5ffb8e5ced3392987a8b73ae3a5f1906367419abd

Comments