MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 27bc5451490039caf7e510d199080dfca6c5514a767146b00d81365ad25ed0f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 27bc5451490039caf7e510d199080dfca6c5514a767146b00d81365ad25ed0f3
SHA3-384 hash: 8875df7dc11ad1d86e6d8d5a757a0f5d399058a9adba68ca13e7a5d29aa895a9f69143931bb93bc5e0f1a1327042db78
SHA1 hash: cc8f08675eeac73e1b1d0c0a8569fd579d4398c3
MD5 hash: f84557829d68b3a34364cf16fcff8027
humanhash: ceiling-princess-michigan-freddie
File name:Swift_pdf.gz
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:654'480 bytes
First seen:2021-02-02 07:00:24 UTC
Last seen:2021-02-02 07:35:25 UTC
File type: gz
MIME type:application/gzip
ssdeep 12288:KHbW1ingTflfnxcpEmUmnIyyyMDePYIzcVVpbt7HDA+5CXf9uBmi6ohr2qmA:x1igrlfxEUBBpDe7olB0Xf9uAoMA
TLSH E1D433B1650831EE6766ECBEEF710535E4934C1658E2E05C88DE9D1480FDC268FEE9E2
Reporter lowmal3

Intelligence

File Origin
# of uploads :
2
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/27bc5451490039caf7e510d199080dfca6c5514a767146b00d81365ad25ed0f3/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-02-02 01:43:09 UTC
AV detection:
4 of 45 (8.89%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=e66fiukjaa44v57fcdizscan7stmkukkozyunmanqe3fvus62dzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/27bc5451490039caf7e510d199080dfca6c5514a767146b00d81365ad25ed0f3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

gz 27bc5451490039caf7e510d199080dfca6c5514a767146b00d81365ad25ed0f3

(this sample)

RemcosRAT

Executable exe 2c8f28660fbd9950150b8acd50fbd5af93f9d36fb8cda86aab3c8a5158e2a818

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2c8f28660fbd9950150b8acd50fbd5af93f9d36fb8cda86aab3c8a5158e2a818
  
Dropping
MD5 937019e3182a6abd742ba25937ca97c2

Comments