MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 015dc32c567aa35f4f201c2d4fe20f7b94d9806bcc5254e57dcbf1cd806b01f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 015dc32c567aa35f4f201c2d4fe20f7b94d9806bcc5254e57dcbf1cd806b01f9
SHA3-384 hash: ed22bcd87d39e5cdebdde777109bf3375e31d16f6e1849357c48b29cef968441ed269f42db7a5fdb6d93169b24e79fd2
SHA1 hash: ce6f37232688e93300ac48e023e26e94fcf345ba
MD5 hash: 23185de0a0d1c9fd0a821add18491483
humanhash: india-may-michigan-network
File name:Adjunto_Serfinanza_0245084182603488863980883876_2418275459763568946922112_99778524626372181718320781
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:572'705 bytes
First seen:2020-11-20 07:57:33 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:1NZ8WavycIkyeMmLaQFAG15cF7nv66cHLI1WIZ:FBa6cKeMmL6G1i9tcHLIZ
TLSH 71C42346C70E7449412E5D348CD9B6DB8E2A3FD9A96F9AC8752CCBCE74580DB7D20B04
Reporter abuse_ch
Tags:Outlook RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: NAM10-MW2-obe.outbound.protection.outlook.com
Sending IP: 40.92.42.51
From: Factura virtual <facturavirtual14@outlook.es>
Subject: EXTRACTO SERFINANZA.
Attachment: Adjunto_Serfinanza_0245084182603488863980883876_2418275459763568946922112_99778524626372181718320781 (contains "Adjunto_Serfinanza_0245084182603488863980883876_2418275459763568946922112_99778524626372181718320781_02236125131579763606_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
114
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/015dc32c567aa35f4f201c2d4fe20f7b94d9806bcc5254e57dcbf1cd806b01f9/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=afo4glcwpkrv6tzadqwu7yqppokntadlzrjfjzl5zpy43adlah4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar 015dc32c567aa35f4f201c2d4fe20f7b94d9806bcc5254e57dcbf1cd806b01f9

(this sample)

RemcosRAT

Executable exe c5378608f92bd8f9e84214eb91c5cf33f8697b08f07f7caf6f1ee553b3fab650

  
Dropping
MD5 3b3d9d0322bb89b4e0e8e868605dcf3a
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c5378608f92bd8f9e84214eb91c5cf33f8697b08f07f7caf6f1ee553b3fab650

Comments