MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 257d6243a03de6756073e02cfa127cacbce690dbedb254cf9ba17a19ab9630d0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 257d6243a03de6756073e02cfa127cacbce690dbedb254cf9ba17a19ab9630d0
SHA3-384 hash: e5a11f6edb9076b68a8a5540ab06b121798e6c12888b66fe1194ea252e0e54deca9e30245a1d0c9edc435b48f3f57dc6
SHA1 hash: afde4b9a09c603dd67f184a017255a225b09ca9c
MD5 hash: 5b260ff0d4a11eeb94a71c1dabc2869c
humanhash: lemon-uniform-stream-mars
File name:Contract Evaluation.pdf (~0.8 MB).img
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'245'184 bytes
First seen:2022-12-18 12:52:24 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:mcDOrCXLi+hviCrw1kIjGqWggSYvqhH1p6FrW2RvJg2S:lD1xNrrw1kIyqWviCFrW2Rvy2
TLSH T18E452399AAD1C187F88B12B147EEA36A7963C3115068C6973B5E0FF47B2C2D74212B4D
TrID 99.4% (.NULL) null bytes (2048000/1)
0.2% (.ISO) ISO 9660 CD image (5100/59/2)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
Reporter cocaman
Tags:img RemcosRAT


Avatar
cocaman
Malicious email (T1566.001)
From: ""Gustavo Belgrano" <admin@gkfnetwork.com>" (likely spoofed)
Received: "from serviscoksa.com (unknown [194.180.48.184]) "
Date: "15 Dec 2022 05:46:11 -0800"
Subject: "Contract Evaluation"
Attachment: "Contract Evaluation.pdf (~0.8 MB).img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
119
Origin country :
n/a
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:CONTRACT.EXE
File size:582'701 bytes
SHA256 hash: d3a2043efc6af7c4ab5141626759c855ae393005862d78c7e325ba585684c5b0
MD5 hash: 84b845c3d2ae78c4b89cf2c532f3037d
MIME type:application/x-dosexec
Signature RemcosRAT
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Jaik.107958.23634.14999.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
context-iso formbook overlay packed remcos shell32.dll
Link:
https://www.filescan.io/uploads/639f0d2fcc739ba77525ca73/reports/8c9bf30d-1fbe-4d8d-aca3-13af95d1d95c/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/257d6243a03de6756073e02cfa127cacbce690dbedb254cf9ba17a19ab9630d0/
Threat name:
Win32.Trojan.Remcos
Create hunting rule
Status:
Malicious
First seen:
2022-12-15 16:17:25 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
22 of 40 (55.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ev6weq5ahxthkydt4awpuet4vs6oneg35wzfjt43uf5btk4wgdia._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/257d6243a03de6756073e02cfa127cacbce690dbedb254cf9ba17a19ab9630d0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

img 257d6243a03de6756073e02cfa127cacbce690dbedb254cf9ba17a19ab9630d0

(this sample)

RemcosRAT

Executable exe d3a2043efc6af7c4ab5141626759c855ae393005862d78c7e325ba585684c5b0

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d3a2043efc6af7c4ab5141626759c855ae393005862d78c7e325ba585684c5b0
  
Dropping
RemcosRAT
  
Dropping
MD5 84b845c3d2ae78c4b89cf2c532f3037d

Comments