MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1768de04bb55948e5d78e0e53e7b64d82c7642fc57ae291b4612e1a0185bfb86. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1768de04bb55948e5d78e0e53e7b64d82c7642fc57ae291b4612e1a0185bfb86
SHA3-384 hash: 618217b9d2817f028fdb194dec1a7a9f85e47e7812b43334c8163ccf657054a07aeb999a87b6ee483a450cc4e78ee604
SHA1 hash: 9a9d45c7d0126adb1120934372b41e518353b993
MD5 hash: d82dd6ccfedec4357be7bb306b2c89d0
humanhash: fruit-tango-dakota-comet
File name:Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:579'778 bytes
First seen:2020-11-20 07:40:25 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:UPlMnTX0/dLfH9zNkQX26a373tpB3+R8NrUhcbvkKNodxlX0TIl:UPOnLmjdzVV87djO61U+AKUxlX0TG
TLSH D5C42371457B0AFA20BAFB8CD8FE062188E3FD40D03FE65560E267D5D59BB68009DB24
Reporter abuse_ch
Tags:ESP geo Outlook RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: NAM11-DM6-obe.outbound.protection.outlook.com
Sending IP: 40.92.19.37
From: Factura virtual <facturavirtual12@outlook.es>
Subject: EXTRACTO SERFINANZA.
Attachment: Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3 (contains "Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3148232413313718104717_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1768de04bb55948e5d78e0e53e7b64d82c7642fc57ae291b4612e1a0185bfb86/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=c5un4bf3kwki4xly4dst463e3awhmqx4k6xcsg2gclq2agc37oda._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar 1768de04bb55948e5d78e0e53e7b64d82c7642fc57ae291b4612e1a0185bfb86

(this sample)

RemcosRAT

Executable exe 13efba52e6268bbc8089e143010d3e9be11ef8c7606a6ecd32b36e9ff60d1bde

  
Dropping
MD5 5b862afb58e54886e055d0de5110e670
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 13efba52e6268bbc8089e143010d3e9be11ef8c7606a6ecd32b36e9ff60d1bde

Comments