MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 09a0b669ae02f3e1c1e20009f34ec0381054d90377e3772ac3ea755d20266f49. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 09a0b669ae02f3e1c1e20009f34ec0381054d90377e3772ac3ea755d20266f49
SHA3-384 hash: 9a609745ad6100774615e49de68eca0d8c636a772716b5dd7f92f6f527849438966951fa022404c10460bfb698afb495
SHA1 hash: 4e94f3acc4519600320ba837181c8912d448fa78
MD5 hash: 598fa1460f1db2d6ce825b5e1f48e043
humanhash: six-kansas-grey-carolina
File name:Quotation.gz
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:458'496 bytes
First seen:2020-10-12 14:54:50 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:eN28HJNiQZKi1iw3xg2q/HdjMLgpEG3k4F/ULIAEn73:W28H7KAiOxgD/Hd/ar4FsZI
TLSH 60A4235D86BCEEAD15979644A158A4C043350F28AA412C21CE2E53EEDD37E9707F0FFA
Reporter abuse_ch
Tags:gz RemcosRAT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: yandex.com
Sending IP: 37.49.225.133
From: stoneadamss@yandex.com
Subject: QUOTATION
Attachment: Quotation.gz (contains "Quotation.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/09a0b669ae02f3e1c1e20009f34ec0381054d90377e3772ac3ea755d20266f49/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-12 11:32:46 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bgqlm2noalz6dqpcaae7gtwahaifjwido7rxokwd5j2v2ibgn5eq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/09a0b669ae02f3e1c1e20009f34ec0381054d90377e3772ac3ea755d20266f49

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

gz 09a0b669ae02f3e1c1e20009f34ec0381054d90377e3772ac3ea755d20266f49

(this sample)

RemcosRAT

Executable exe 7f767ca610703568153db9fd01aa25c9fb1e4e5c740d669699649fdd4785ab69

  
Dropping
MD5 a701064cdae33f6b38c25af94891c6ce
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7f767ca610703568153db9fd01aa25c9fb1e4e5c740d669699649fdd4785ab69

Comments