MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2ab9a927ad94b422a58b9e3121fd16c5ca650590d22a709093389d65d19b5699. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2ab9a927ad94b422a58b9e3121fd16c5ca650590d22a709093389d65d19b5699
SHA3-384 hash: f62acad3060737785999387126d6af638ba55d419a70ba32d269e31f66f503729ed6b9d70a158c97bfd2460f78f30198
SHA1 hash: 10eb9d5ca11b1661e01f0b647ea1c2a33b7ac61c
MD5 hash: 7dc0f1ea5c59da519550c0b2c70ee7b3
humanhash: potato-missouri-carpet-summer
File name:Adjunto_Extracto_418959787987943996849520790_14002695581661652004972689_8860076098794497258031_05524
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:593'388 bytes
First seen:2020-11-19 06:51:11 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:sU+rjsT50ecwG3QQQWrSs+JRArkdlzPcrTN3QIvkMu:4rG57cvrSsuhdhcK1D
TLSH 7EC4236FEC3AC4F108E76034A80667C18C5455E3CC69772C69978463EE2935127FEADB
Reporter abuse_ch
Tags:Outlook RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: NAM02-BL2-obe.outbound.protection.outlook.com
Sending IP: 40.92.3.64
From: info. Extracto <tesoreria32procolombia@outlook.es>
Subject: EXTRACTO SERFINANZA.
Attachment: Adjunto_Extracto_418959787987943996849520790_14002695581661652004972689_8860076098794497258031_05524 (contains "Adjunto_Extracto_418959787987943996849520790_14002695581661652004972689_8860076098794497258031_05524902802403175252318_pdf.exe")

RemcosRAT C2:
databasepropersonombrecomercialideasearchwords.services:7580

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2ab9a927ad94b422a58b9e3121fd16c5ca650590d22a709093389d65d19b5699/
Threat name:
ByteCode-MSIL.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-11-19 06:52:06 UTC
AV detection:
13 of 28 (46.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fk42sj5nss2cfjmltyysd7iwyxfgkbmq2ivhbeethcowlum3k2mq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar 2ab9a927ad94b422a58b9e3121fd16c5ca650590d22a709093389d65d19b5699

(this sample)

RemcosRAT

Executable exe 936027b0c02941505eb900045a050c0806b30a8d49c7d34fff9eff42a8168b27

  
Dropping
MD5 84c46410f77862accd97fe0c405b544a
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 936027b0c02941505eb900045a050c0806b30a8d49c7d34fff9eff42a8168b27

Comments