MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 082fdf6851d7a1e0ec17b90310494a11a18b359b1ec0e0ab55bb4fd294703e79. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 082fdf6851d7a1e0ec17b90310494a11a18b359b1ec0e0ab55bb4fd294703e79
SHA3-384 hash: c4bb71927635d4f74bc133e5a3676b8c7e6eaf650efb070432d74bb4bc18bebb2dc9b7d3a24f31024db6b958301483d3
SHA1 hash: d3ad06c79856c7f42df4f168f0b603df213b0d7c
MD5 hash: f598a15e1936fafb22769fed9c5a54a8
humanhash: grey-fifteen-bakerloo-spaghetti
File name:New Order_pdf.gz
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:218'857 bytes
First seen:2020-04-21 06:42:36 UTC
Last seen:2020-04-26 10:13:34 UTC
File type: gz
MIME type:application/gzip
ssdeep 6144:nRWgBYnnebZisynmnBKRf1fElJYCaACdm:RdGeVis4Gq1fElJ3Em
TLSH 772423ECD70AD4592F3FDEA71A9A7DD3D0BB610078A65A53CBE3BB505DA4D00A23D804
Reporter cocaman
Tags:gz RemcosRAT


Avatar
cocaman
Malicious email
From: Cynthia Yeo <cynthia.yeo@riotinto.com>
Received: from server.webhostingnepal.com (server.webhostingnepal.com [107.161.182.74])
Date: Mon, 20 Apr 2020 19:15:28 -0700
Subject: RE: Invoice Downpayment
Attachment: Swift_pdf.gz

Intelligence

File Origin
# of uploads :
2
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.41121.7977.25580.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-04-21 23:32:16 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
24 of 31 (77.42%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bax562cr26q6b3axxebraskkcgqywnm3d3aobk2vxnh5ffdqhz4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

gz 082fdf6851d7a1e0ec17b90310494a11a18b359b1ec0e0ab55bb4fd294703e79

(this sample)

RemcosRAT

Executable exe 433e1ee086994d93024a91489e38956f763560211233565b0583e411c7cb071f

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 433e1ee086994d93024a91489e38956f763560211233565b0583e411c7cb071f

Comments