MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b3437e9b7960e510a1a49d031f4171edcbf2fbbf6e4684637b8c2c67d3af2a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2b3437e9b7960e510a1a49d031f4171edcbf2fbbf6e4684637b8c2c67d3af2a3
SHA3-384 hash: d8722221439204b61e584b0445949bda802b014d18c3065af531268df4b442525baa66bacca0bec523d18f005b91217a
SHA1 hash: 80902c9ce5803d29f9afa0c24b464d016e3e995f
MD5 hash: 75886a56ce2be0863567a5e49745cb6e
humanhash: salami-finch-snake-nitrogen
File name:REM0000007.Z
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:85'642 bytes
First seen:2021-02-23 17:41:31 UTC
Last seen:2021-02-26 18:15:29 UTC
File type: zip
MIME type:application/zip
ssdeep 1536:HgvSZBYyje+CG/8r74Hcflvg9bMkWL353lhGKEiilJgZUw:HgvSZB7ND/88H0kqlG97lJgZN
TLSH 148312DA4DEB8CE4CC4F1ED73C283D8AD598551D0561B49AD8642049EB208FFB2DADC9
Reporter GovCERT_CH
Tags:RemcosRAT

Intelligence

File Origin
# of uploads :
6
# of downloads :
259
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2b3437e9b7960e510a1a49d031f4171edcbf2fbbf6e4684637b8c2c67d3af2a3/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2021-02-23 17:42:08 UTC
AV detection:
12 of 47 (25.53%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fm2dp2nxsyhfccq2jhidd5axd3ol6l5363sgqrrxxdbmm7j26krq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2b3437e9b7960e510a1a49d031f4171edcbf2fbbf6e4684637b8c2c67d3af2a3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip 2b3437e9b7960e510a1a49d031f4171edcbf2fbbf6e4684637b8c2c67d3af2a3

(this sample)

RemcosRAT

Executable exe 0b39a4fbccfbe395762a7c497dd64cea9236fb1c156075f290131c2531c53deb

  
Dropped by
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0b39a4fbccfbe395762a7c497dd64cea9236fb1c156075f290131c2531c53deb
  
Dropping
MD5 f5f6739d2197da204c48865971147d50

Comments