MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1bedc89860b51aef7ac633a3c63e9367b0483c25b7c079b4eb545b537df84c1b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1bedc89860b51aef7ac633a3c63e9367b0483c25b7c079b4eb545b537df84c1b
SHA3-384 hash: e4a7b2f2d322e16ffdc7e0c0335e3ff6e1b6e35f1b4136d815067b5b3e78a6fb1f74358d627617bdf671287935f6775f
SHA1 hash: e0a796e6ee66e271dbdc4dbe36fb0bc3b2836344
MD5 hash: 390e2da4e6d927581aa785756cb29371
humanhash: massachusetts-cardinal-hawaii-ink
File name:Solicitud.uu
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:231'042 bytes
First seen:2020-08-14 15:35:48 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:uLAlRKxu4PWO80JeDqdrX58kzwY7SnM/yal:uLA/Mu+JemdL5mctl
TLSH AE34220C0AA94945369CF9C9E14BDF9192E6A111CE6CCF6E8C8573FBD2A05D2D48E43F
Reporter abuse_ch
Tags:Outlook RAT RemcosRAT uu


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: NAM10-BN7-obe.outbound.protection.outlook.com
Sending IP: 40.92.40.36
From: VaNeSsA C. <maireces@hotmail.com>
Subject: DOCUMENTO ADJUNTO
Attachment: Solicitud.uu (contains "Solicitud.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1bedc89860b51aef7ac633a3c63e9367b0483c25b7c079b4eb545b537df84c1b/
Threat name:
Win32.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-08-14 15:37:04 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dpw4rgdawuno66wggor4mputm6yeqpbfw7ahtnhlkrnvg7pyjqnq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/1bedc89860b51aef7ac633a3c63e9367b0483c25b7c079b4eb545b537df84c1b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar 1bedc89860b51aef7ac633a3c63e9367b0483c25b7c079b4eb545b537df84c1b

(this sample)

RemcosRAT

Executable exe 8641910c61f213b8f3643405387fcb92161e3e11fde5f2546b58dce702d702a6

  
Dropping
MD5 d5399968edb8c3c6fb0ffabe1d74c2cd
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8641910c61f213b8f3643405387fcb92161e3e11fde5f2546b58dce702d702a6

Comments