MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 362372e1b3df1a5df4e537edc19366b048d180fd872d8a3f771064bff042723f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 362372e1b3df1a5df4e537edc19366b048d180fd872d8a3f771064bff042723f
SHA3-384 hash: 82494d9953ce8d66462d5255f3641fb3bc3694f835b88b569ce5ff383ac8e0930ba00a433777b2fa7b8f34b8570f7360
SHA1 hash: e2c9e5a78a68801684cd6c3b80d878a3a4fea933
MD5 hash: 97b135c8c75f4e9faa5ce6a38df03db7
humanhash: pasta-freddie-xray-fifteen
File name:Scan Payment.pdf.zip
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:373'134 bytes
First seen:2021-08-03 08:42:15 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:LJxaQ9wiYugIbJSBaWKh/2XbcYbU1o8pvwmNAy5h4ZKhUKjidKsovRYHbBte9378:Lj9wbFX3KR2QYwy8pvxKy4yjylovRpL8
TLSH T11A842371042384AACF5CB96AD4C27AEC86B8B6075854F3785D9D7D3A1CA0E0B9CDE17C
Reporter cocaman
Tags:RemcosRAT zip


Avatar
cocaman
Malicious email (T1566.001)
From: ""Adam (Credit Control)" <info@890oppool34.ga>" (likely spoofed)
Received: "from rdns0.890oppool34.ga (607877-cx65919.tmweb.ru [94.228.112.235]) "
Date: "Tue, 03 Aug 2021 01:26:19 -0700"
Subject: "FW: Payment Scan"
Attachment: "Scan Payment.pdf.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
260
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/362372e1b3df1a5df4e537edc19366b048d180fd872d8a3f771064bff042723f
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/362372e1b3df1a5df4e537edc19366b048d180fd872d8a3f771064bff042723f/
Threat name:
Win32.Trojan.Sabsik
Create hunting rule
Status:
Malicious
First seen:
2021-08-03 08:43:06 UTC
File Type:
Binary (Archive)
Extracted files:
15
AV detection:
12 of 46 (26.09%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gyrxfynt34nf35hfg7w4de3gwbendah5q4wyup3xcbsl74ccoi7q._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/210803-lf42wfc62s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/362372e1b3df1a5df4e537edc19366b048d180fd872d8a3f771064bff042723f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip 362372e1b3df1a5df4e537edc19366b048d180fd872d8a3f771064bff042723f

(this sample)

RemcosRAT

Executable exe 7fd27941dad49771148973376733a73f0b9bd2cae4cb7fdb5c999f8254869995

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7fd27941dad49771148973376733a73f0b9bd2cae4cb7fdb5c999f8254869995

Comments