MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0b787611e9d9abbcdf9cd71af3f90f4eb9eb7c57c4514bc886023cd6d9ae3c08. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0b787611e9d9abbcdf9cd71af3f90f4eb9eb7c57c4514bc886023cd6d9ae3c08
SHA3-384 hash: 960140fcffd1a719a0ec7353eab8948cfcff4dda1054bd4d03fffd5111b693029044ddc79de3253db1bbe18c37c110d6
SHA1 hash: 20a9d1f577a28b37e67a6ba02a07681689136c93
MD5 hash: 050ce0f63b414d266fc9d8223e51fc67
humanhash: diet-sierra-kansas-crazy
File name:Factura Serfinanza_05031367918_64895_9293161158346_010435_561583349364384812929954_657811397647994.t
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:900'233 bytes
First seen:2020-12-10 11:09:13 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:Dlu95MRvSYCtMXkX7AWYrDhCXmutr47aIQJtG:s9uGtMXwDkDYptrO4Q
TLSH 3C1523B4CE0E1F957075CC0AA88FD1E5C768007FBA606FC2F896997A9AA5044127BF53
Reporter abuse_ch
Tags:ESP geo Outlook RAT RemcosRAT t


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: NAM04-CO1-obe.outbound.protection.outlook.com
Sending IP: 40.92.10.31
From: patricia garcia montoya <patriciagarciaconta@hotmail.com>
Subject: FACTURA EN MORA SERFINANZA.
Attachment: Factura Serfinanza_05031367918_64895_9293161158346_010435_561583349364384812929954_657811397647994.t (contains "Factura Serfinanza_05031367918_64895_9293161158346_010435_561583349364384812929954_657811397647994_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
192
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.DrodRar-A.5489.13855.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0b787611e9d9abbcdf9cd71af3f90f4eb9eb7c57c4514bc886023cd6d9ae3c08/
Threat name:
ByteCode-MSIL.Trojan.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-12-10 11:10:07 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bn4hmepj3gv3zx4424nph6ipj246w7cxyriuxsegai6nnwnohqea._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0b787611e9d9abbcdf9cd71af3f90f4eb9eb7c57c4514bc886023cd6d9ae3c08

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar 0b787611e9d9abbcdf9cd71af3f90f4eb9eb7c57c4514bc886023cd6d9ae3c08

(this sample)

RemcosRAT

Executable exe f43a96ccf1d23d7dda1abbc2bea16ecbb2fb43b2f05e4015ff69c02e2c144ab2

  
Dropping
MD5 5e26a36151f74845b48241366ffe6741
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f43a96ccf1d23d7dda1abbc2bea16ecbb2fb43b2f05e4015ff69c02e2c144ab2

Comments