MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 37657fe5dd43b00d35493044d2de86c2971c0686f0ab66e10923154e4f5423a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 37657fe5dd43b00d35493044d2de86c2971c0686f0ab66e10923154e4f5423a5
SHA3-384 hash: 582dd5775bc86c773aa94515241d0ed7c8df79922471063bdd00fe5cc631f89b6235e427147e686240fd606e4f74eaa6
SHA1 hash: 62d51d355b02c585beaeac915797a515cbf1e36b
MD5 hash: 1e006a6cd352904b90e9e276bf5d6e6c
humanhash: venus-equal-sweet-vermont
File name:Purchase order.rar
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:476'081 bytes
First seen:2020-08-06 06:34:43 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:FXO3nwEbLd7CseEEq/AphktKKRngCdcJ04Jaaet2OT6i:EnzEm3//sBJTS2OWi
TLSH 34A423CCB0295A35CBDCC4BD90C381EAA793F4BD72BD9CE129527D91284628719A41FF
Reporter abuse_ch
Tags:rar RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: cesales.com
Sending IP: 37.49.229.235
From: Wecon Trading Limited <customerservice@cesales.com>
Subject: Purchase Order
Attachment: Purchase order.rar (contains "INQUIRY.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/37657fe5dd43b00d35493044d2de86c2971c0686f0ab66e10923154e4f5423a5/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 07:57:19 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=g5sx7zo5ioya2nkjgbcnfxugyklrybug6cvwnyijemku4t2ueosq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/37657fe5dd43b00d35493044d2de86c2971c0686f0ab66e10923154e4f5423a5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar 37657fe5dd43b00d35493044d2de86c2971c0686f0ab66e10923154e4f5423a5

(this sample)

RemcosRAT

Executable exe b4f2ec035ed04a9dc31102c9ecfa331fec9e3c611aa8ac70b9c07e5574d47df1

  
Dropping
MD5 31055a72ddb49284c338d58ffdb147d4
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b4f2ec035ed04a9dc31102c9ecfa331fec9e3c611aa8ac70b9c07e5574d47df1

Comments