MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2dfb559709a3aaaa4d1be98ae6262000cbaaac29f9b0f1e2ca7bafc33d5c07e6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 6

Intelligence 6 IOCs YARA 3 File information Comments

SHA256 hash:	2dfb559709a3aaaa4d1be98ae6262000cbaaac29f9b0f1e2ca7bafc33d5c07e6
SHA3-384 hash:	b64762d229c17b65650486a7499b6e3fd87cd1f9217c506f58037f0c194aab91524e77afdf5646211761cd47fc0c9d89
SHA1 hash:	381159067d95ef8d9cad5617a75a2cc12d2349f7
MD5 hash:	87c1dde8219100ca760d1dcd0c71072f
humanhash:	sad-stream-sad-high
File name:	SWIFT050924.rar
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	520'367 bytes
First seen:	2024-09-07 18:39:38 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:YEVFSoADD2Wh2mzMWpVi+vVDjV3LLiAe+r4kM87l6KFn:YGFbA3hhhzM0g+tDFiK6qn
TLSH	T10FB42337FF291ED5C1D858EC277C160263A9576649CB36A4B007DC1E5E037EA837A0AE
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	cocaman
Tags:	rar RemcosRAT SWIFT

cocaman

Malicious email (T1566.001)
From: ""CitiBank|Aafaaq Hassam" <accnt1@citibasia.com>" (likely spoofed)
Received: "from box0.citibasia.com (box0.citibasia.com [193.42.38.120]) "
Date: "5 Sep 2024 07:04:54 +0000"
Subject: "RE: Wire Transfer-SWIFT050924"
Attachment: "SWIFT050924.rar"

Intelligence

File Origin

# of uploads :

# of downloads :

386

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	SWIFT050924.vbs
File size:	707'778 bytes
SHA256 hash:	cf932f84c26f6d3665b03afbe44e50bf77342af73b4a1f101d48a5750fb3bf23
MD5 hash:	2017ec3e440a42016679cfca89021367
MIME type:	text/plain
Signature	RemcosRAT

Vendor Threat Intelligence

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66dc9e094b4e27c595e03616

Tags:

Stealth Trojan Talu

Gathering data

Verdict:

Malicious

Labled as:

Trojan.PasswordStealer.GenericS

Link:

https://www.hybrid-analysis.com/sample/2dfb559709a3aaaa4d1be98ae6262000cbaaac29f9b0f1e2ca7bafc33d5c07e6

Result

Verdict:

UNKNOWN

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2dfb559709a3aaaa4d1be98ae6262000cbaaac29f9b0f1e2ca7bafc33d5c07e6/

Threat name:

Win32.Backdoor.Remcos

Status:

Malicious

First seen:

2024-09-05 10:11:13 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

13 of 38 (34.21%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fx5vlfyjuovkuti35gfomjraadf2vlbj7gypdywkpox4gpk4a7ta._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2dfb559709a3aaaa4d1be98ae6262000cbaaac29f9b0f1e2ca7bafc33d5c07e6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Detect_Malicious_VBScript_Base64 Create hunting rule
Author:	daniyyell
Description:	Detects malicious VBScript patterns, including Base64 decoding, file operations, and PowerShell.