MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 006d8434c4eaff7d715c29012b0d9f00b43a52da5a2a438b284014122e664369. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 006d8434c4eaff7d715c29012b0d9f00b43a52da5a2a438b284014122e664369
SHA3-384 hash: cf2ac380b5c2c480bc9be1d82f609dc5c4517d046d809e5c035255efc99eb5b031a7e5dc14057a6156514bb80f8c1ecb
SHA1 hash: fa951488930a0e926aba6d75809fb29316cbdd98
MD5 hash: 7965cb81f0b9fc92e9e02e53bd32854e
humanhash: kilo-romeo-sad-aspen
File name:PO-3175704534,PDF.cab
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:886'784 bytes
First seen:2021-04-07 06:00:23 UTC
Last seen:Never
File type: cab
MIME type:application/x-iso9660-image
ssdeep 24576:YebsanDn4AomQlSesV+qQ8B8cHvNlEXHPzj:UaDnn7QcjHEXvz
TLSH BE15D02233846F65E17EA7759060516093F2FD07E336DA8E7C9CB49D6B32AC1C262B53
Reporter abuse_ch
Tags:cab RemcosRAT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: cloudhost-2762388.us-midwest-1.nxcli.net
Sending IP: 8.36.41.118
From: 양타라 Yang T. Seo <daeeun@de.co.kr>
Subject: New Order request Ref : E100-#3175704534
Attachment: PO-3175704534,PDF.cab (contains "PO-#3175704534,PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
178
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_badexts72.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/006d8434c4eaff7d715c29012b0d9f00b43a52da5a2a438b284014122e664369/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-04-07 05:44:05 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=abwyinge5l7x24k4feaswdm7ac2duuw2livehcziiakbeltginuq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/006d8434c4eaff7d715c29012b0d9f00b43a52da5a2a438b284014122e664369

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

cab 006d8434c4eaff7d715c29012b0d9f00b43a52da5a2a438b284014122e664369

(this sample)

RemcosRAT

Executable exe c9ecc8ac0893475d6852cd5aadf9ed6c5378e45f281b92ee948def1c7f9263f3

  
Dropping
MD5 c7e1546f914c7a662cd6c373d716f50e
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c9ecc8ac0893475d6852cd5aadf9ed6c5378e45f281b92ee948def1c7f9263f3

Comments