MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2881ebe7dff59d9cc638b491e4212369cca7dafee74ba3c376bdfb25a1d1a471. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2881ebe7dff59d9cc638b491e4212369cca7dafee74ba3c376bdfb25a1d1a471
SHA3-384 hash: 664ea9ebe582ea6af295c5d2e7373ed5a2284103a27ae4026ec0f80a48d81e5a030470d2e7a750d84a15649fddbb7211
SHA1 hash: c440c2cd72c7add01df806558035428573b485a3
MD5 hash: 8376b85879de72186e8c8579561cd77c
humanhash: missouri-glucose-march-pizza
File name:Proof of Payment.img
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'638'400 bytes
First seen:2020-10-13 12:40:33 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:3jo1Kn74XfBU8Rup5qmz5zd9QkuoNcAOQ9GeUH1J:30s70fBUdLqM5ck7NcR7
TLSH E475AFF2F2914437D1271B788C1BA3B96935BE132E28A886BBF91D0C5F356417C39297
Reporter abuse_ch
Tags:img RemcosRAT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: rdns0.optifus.xyz
Sending IP: 149.56.8.130
From: noreply@fnb.co.za
Subject: Proof of Payment [Notification Service]
Attachment: Proof of Payment.img (contains "Proof Of Payment_ _ Notificaton_Service_1.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2881ebe7dff59d9cc638b491e4212369cca7dafee74ba3c376bdfb25a1d1a471/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fca6xz676wozzrrywsi6iijdnhgkpwx645f2hq3wxx5slioruryq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Remcos
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2881ebe7dff59d9cc638b491e4212369cca7dafee74ba3c376bdfb25a1d1a471

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

img 2881ebe7dff59d9cc638b491e4212369cca7dafee74ba3c376bdfb25a1d1a471

(this sample)

RemcosRAT

Executable exe c358b44f578fd2dedbb1899038415395ae2052c113aaa149481cde295e022bda

  
Dropping
MD5 2f34ecaa3ce61f37ae89127383466d13
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c358b44f578fd2dedbb1899038415395ae2052c113aaa149481cde295e022bda

Comments