MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2bf07c94fcdcae14739e63c97618afd887d3e750d9c5f6bacd249b50ebefd151. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2bf07c94fcdcae14739e63c97618afd887d3e750d9c5f6bacd249b50ebefd151
SHA3-384 hash: 8ea94c909fdaeccc14dfd90d1798908d6aeb96d4d78281d4f7388cf52f1b478e09bcdb2438dfef7abf36b8c2fa98cb8f
SHA1 hash: 583d036be4f6465b90983f56a06f4178fec9ab1e
MD5 hash: 5185c05854ef402224cf4c5e07893641
humanhash: oven-hot-princess-oranges
File name:09000090INVOICE.7Z
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:135'839 bytes
First seen:2021-01-18 09:03:18 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:49KtwYzl+2uSdMKw0hsC/sDqtQMgkIRDdg7LLWPQSe84Ys:49KtDl+2/s+sDqCDDKCI+hs
TLSH 98D3127284B3B84F42A4760F7923737C89F5359A634102FC9A74C58C3E93AEA15A19ED
Reporter abuse_ch
Tags:7z


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: hosted-by.rootlayer.net
Sending IP: 185.222.58.152
From: sales10@tzrising.com
Subject: Purchase order / Proforma Request.
Attachment: 09000090INVOICE.7Z (contains "09000090INVOICE.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
118
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fn23.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2bf07c94fcdcae14739e63c97618afd887d3e750d9c5f6bacd249b50ebefd151/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-18 03:39:30 UTC
AV detection:
16 of 46 (34.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fpyhzfh43sxbi446mpexmgfp3cd5hz2q3hc7nownesnvb27p2fiq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2bf07c94fcdcae14739e63c97618afd887d3e750d9c5f6bacd249b50ebefd151

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip 2bf07c94fcdcae14739e63c97618afd887d3e750d9c5f6bacd249b50ebefd151

(this sample)

RemcosRAT

Executable exe 9d692165cbb8d2a181769b723e7300b02f534fec4563d4bd155b4c293d6ebe72

  
Dropping
MD5 f4d2193e00008bd236c7658fc0cff060
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9d692165cbb8d2a181769b723e7300b02f534fec4563d4bd155b4c293d6ebe72

Comments