MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0535b8a5939c41dcf958e1d2e950f05a3d505351141b457b8a1faafdc617b1aa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0535b8a5939c41dcf958e1d2e950f05a3d505351141b457b8a1faafdc617b1aa
SHA3-384 hash: d5fabd193426f46ec71146e0ac9e4d9c5cdc7ce20a5abcd5dd85c72467f6acdd151d2d1b830271e8f8db7b68ab1be94b
SHA1 hash: 95a638ec1353bc26faba9cb164cbbeb24277c4e4
MD5 hash: f32a62a18b2b6cabbf2ff035899ca669
humanhash: salami-maine-hot-arizona
File name:SERFINANZA_ADJUNTO_9695451573392712899247_2147161820426097673_187809811078594203505679279158_6666787
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:185'148 bytes
First seen:2020-12-28 08:02:01 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:z42YT6pimKHO5zqbjHcMv3plVcJQJux5SSfQxtkBLHHtbwQRYGp8SApD7aBFTTDE:GXmKHO5zm8Mv+WJux8xcJsQq4xT/Wb1
TLSH 360412804D35FEE279FEE2FCEC85028BE2D35574BD662038D3A199431A82730A661ED5
Reporter abuse_ch
Tags:ESP geo Outlook RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: NAM11-BN8-obe.outbound.protection.outlook.com
Sending IP: 40.92.20.67
From: info. Extracto <tesoreria39procolombia@outlook.es>
Subject: FACTURA EN MORA, REPORTE NEGATIVO EN DATACREDITO
Attachment: SERFINANZA_ADJUNTO_9695451573392712899247_2147161820426097673_187809811078594203505679279158_6666787 (contains "SERFINANZA_ADJUNTO_9695451573392712899247_2147161820426097673_187809811078594203505679279158_6666787508879385718216085_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
497
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0535b8a5939c41dcf958e1d2e950f05a3d505351141b457b8a1faafdc617b1aa/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-12-28 08:02:13 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=au23rjmttra5z6ky4hjosuhqli6vau2rcqnuk64kd6vp3rqxwgva._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0535b8a5939c41dcf958e1d2e950f05a3d505351141b457b8a1faafdc617b1aa

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar 0535b8a5939c41dcf958e1d2e950f05a3d505351141b457b8a1faafdc617b1aa

(this sample)

RemcosRAT

Executable exe 483ceb8e56d7a31cab2e789ddb77c34107700904d40a0dcf60552b56a4c3e911

  
Dropping
MD5 80d443f86ee478fdbc57527723a00ba5
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 483ceb8e56d7a31cab2e789ddb77c34107700904d40a0dcf60552b56a4c3e911

Comments