MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ad767a48d94965416dbcf6dd21ab63f686aeff22c1de9d10cf5ac2cebafbe40. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1ad767a48d94965416dbcf6dd21ab63f686aeff22c1de9d10cf5ac2cebafbe40
SHA3-384 hash: a852dfae54ee2281af18e6d575d320148b073340a0fd7cf862f8069db1783206435de07c3a841ece6c9c0e8cf6bf5427
SHA1 hash: 4ae886adfbf0b48b2db5625369124ca06813f12e
MD5 hash: 4531181a883d59daa3f7768d717b8b0b
humanhash: stream-cup-black-seventeen
File name:Amit Order598467588,pdf.zip
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:89'662 bytes
First seen:2020-08-05 07:00:45 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 1536:YbkFJZzsJ75QYtcfUTWY1jdKpplQehc5X1YAdCf1THpAW5r53:YwFfzsJ75HwUTWY1ZSQehc5iAdeAs53
TLSH 439312F2942017348DD31C7F9A64A72E66C5FF72B0806B61083C6DA57A2839CE1791DE
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: ptmatsuo.co.id
Sending IP: 202.74.72.84
From: Amit <amit@aonenonwoven.com>
Subject: New Purchase Order
Attachment: Amit Order598467588,pdf.zip (contains "Amit Order598467588,pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.26176.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1ad767a48d94965416dbcf6dd21ab63f686aeff22c1de9d10cf5ac2cebafbe40/
Threat name:
ByteCode-MSIL.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 07:02:07 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dllwpjensslfifw3z5w5egvwh5ugv37sfqo6tuim6wwcz25pxzaa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Remcos
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1ad767a48d94965416dbcf6dd21ab63f686aeff22c1de9d10cf5ac2cebafbe40

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip 1ad767a48d94965416dbcf6dd21ab63f686aeff22c1de9d10cf5ac2cebafbe40

(this sample)

RemcosRAT

Executable exe 0b8d469babc7b057403a1d7ca0f781c9a675523941cfcc8bb6eae582680746c4

  
Dropping
MD5 b2805d0ca02a91d5d6c1deee9318a46e
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0b8d469babc7b057403a1d7ca0f781c9a675523941cfcc8bb6eae582680746c4

Comments