MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 12aeb793b7519ab8ea043af63c0fa74b956b08f16f2811abd8671b8476c01277. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 12aeb793b7519ab8ea043af63c0fa74b956b08f16f2811abd8671b8476c01277
SHA3-384 hash: 0606d363f801cba1b83d3afdd906554da9d6ddcfa22955f7babc656d5ca86b1297d269011bab76d2675a7c44f22c1571
SHA1 hash: 3bfc850237d1904341dc3505b088ef315b7094b8
MD5 hash: aa9065da78354dc8b759406b4a0e55f4
humanhash: helium-yellow-wyoming-whiskey
File name:20200910 payment printout pdf.rar
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:449'915 bytes
First seen:2020-09-11 10:02:11 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:7wjdfXsCNJ+ZnT3fUmhcZ65UH5rc0fzHpQiMSRg7V:+dfcwJ+J3sR3JlfbpQ9SREV
TLSH 03A423F4D75CD8E38E61B772C9A6E9C52F004A0B8FD399C540F6101D6275E48A2DAB3B
Reporter cocaman
Tags:rar RemcosRAT


Avatar
cocaman
Malicious email
From: V, Karthik <KarthikV@eaton.com>
Received: from eaton.com (unknown [64.52.174.102])
Date: 11 Sep 2020 02:56:10 -0700
Subject: Deposit Payment TT Confirmation Switf Copy. 10th Sept, 2020
Attachment: 20200910 payment printout pdf.rar

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/12aeb793b7519ab8ea043af63c0fa74b956b08f16f2811abd8671b8476c01277/
Threat name:
Win32.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2020-09-11 08:42:50 UTC
File Type:
Binary (Archive)
Extracted files:
28
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ckxlpe5xkgnlr2qehl3dyd5hjokwwchrn4ubdk6ym4nyi5wacj3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/12aeb793b7519ab8ea043af63c0fa74b956b08f16f2811abd8671b8476c01277

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar 12aeb793b7519ab8ea043af63c0fa74b956b08f16f2811abd8671b8476c01277

(this sample)

RemcosRAT

Executable exe d03c620368e784bd2864a85b75e35374a12ee57b3637049f039e196534159d2b

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d03c620368e784bd2864a85b75e35374a12ee57b3637049f039e196534159d2b
  
Dropping
RemcosRAT

Comments