MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 26049ed4bd052c42cfe6896543c80eafe61e04d6a610074ee1642320b88e61fd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 26049ed4bd052c42cfe6896543c80eafe61e04d6a610074ee1642320b88e61fd
SHA3-384 hash: ac12b1897905891917ea17461d1c88322800ede1d1c21195ff6dd9111ca0906e46dce8c478c4fdaba88e23959b23fee7
SHA1 hash: 697092807038863331565d60f2f626df20b8aae8
MD5 hash: d1965896010f9729b07e834cc2e99b9c
humanhash: sad-violet-stream-connecticut
File name:Cobro Juridico_0356065519_386993_366879106856695652_279042970_6819295296394370_168730221494.tgz
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:596'025 bytes
First seen:2020-11-19 07:21:05 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:neO68z1WOLq0IYhyZrPgVducPKm8JcTAgs2aFmqsnN0q5XAI:aaMaR4TghPKmR1bNaI
TLSH 64C4232429019CBF42D9347C67AFD1C45779BDC286AB242A34DD3C78F5E573983E22A8
Reporter abuse_ch
Tags:Outlook RAT RemcosRAT tgz


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: EUR04-VI1-obe.outbound.protection.outlook.com
Sending IP: 40.92.75.102
From: Prima Donna sas <primadonna2018@hotmail.com>
Subject: COBRO JURIDICO SERFINANZA.
Attachment: Cobro Juridico_0356065519_386993_366879106856695652_279042970_6819295296394370_168730221494.tgz (contains "Cobro Juridico_0356065519_386993_366879106856695652_279042970_6819295296394370_168730221494_pdf.exe")

RemcosRAT C2:
databasepropersonombrecomercialideasearchwords.services:7580 (186.169.53.6)

Intelligence

File Origin
# of uploads :
1
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/26049ed4bd052c42cfe6896543c80eafe61e04d6a610074ee1642320b88e61fd/
Threat name:
ByteCode-MSIL.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-11-19 07:22:05 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=eycj5vf5auweft7grfsuhsaov7tb4bgwuyiaotxbmqrsboeomh6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar 26049ed4bd052c42cfe6896543c80eafe61e04d6a610074ee1642320b88e61fd

(this sample)

RemcosRAT

Executable exe f6c8f18b6a8db8307ea07c171236d118f91924e497027eeb305800ba2eee4fbe

  
Dropping
MD5 24e4c8739017f0797882d029cb6350b8
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f6c8f18b6a8db8307ea07c171236d118f91924e497027eeb305800ba2eee4fbe

Comments