MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 240962dca128e601bd3bbaabf128d7f79eaa1e52b3ce29a8dcfeaf1b9e8635f4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 240962dca128e601bd3bbaabf128d7f79eaa1e52b3ce29a8dcfeaf1b9e8635f4
SHA3-384 hash: cb98ff3e80790f7d804dcce182f7e14a8260904518dfc5ad09c0fd2e3c447b4dd04bde2c401a5966dff06fa253886a42
SHA1 hash: 1c6c71bb00bde682e208bb8742348fa71bcdf588
MD5 hash: dee644872518bad0830557a38bb9857e
humanhash: yellow-jupiter-mars-freddie
File name:HSBC CUSTOMER REMITTANCE COPY. PPTX____________________________.gz
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:113'697 bytes
First seen:2021-03-31 00:51:45 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:bLUy1OibuKgZYM02IiJbrWSNQuxnjpHQYQ:bAy8wuHuKHtjpHQH
TLSH 30B31257D993305EF10E6D3CEB80287156F76E8D1B0FB7B981581F8B4BC6AA0D2249D0
Reporter GovCERT_CH
Tags:RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
296
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.DownLoader38.17696.12608.4798.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/240962dca128e601bd3bbaabf128d7f79eaa1e52b3ce29a8dcfeaf1b9e8635f4
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-03-30 18:20:52 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=eqewfxfbfdtadpj3xkv7ckgx66pkuhsswphctkg472xrxhuggx2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/240962dca128e601bd3bbaabf128d7f79eaa1e52b3ce29a8dcfeaf1b9e8635f4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip 240962dca128e601bd3bbaabf128d7f79eaa1e52b3ce29a8dcfeaf1b9e8635f4

(this sample)

RemcosRAT

Executable exe 90a634ffa9eb1fc2dd8aeaabf1aed592a4cf18a824f5b9160f052ac642eeb79a

  
Dropped by
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 90a634ffa9eb1fc2dd8aeaabf1aed592a4cf18a824f5b9160f052ac642eeb79a
  
Dropping
MD5 97f5440beb991b4724e623711cc07cfa

Comments