MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a6da7e2c95852b644635b5ec5375a1736306b1c5bb3a8a0d82a13ecaf4cef8b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3a6da7e2c95852b644635b5ec5375a1736306b1c5bb3a8a0d82a13ecaf4cef8b
SHA3-384 hash: 0af97720fcc9afdb1e04022fec350c9410ad0ab739c8b1d9fe78ca3a31d0ef3ba595bdcfeb91d06cb7e38705d89f0a82
SHA1 hash: 2adf9c9a506f5c12a0a40596e956262b4aeeb13f
MD5 hash: 484d2046854c3136ca72e163b19770a6
humanhash: island-nitrogen-monkey-mike
File name:ABERTAX PURCHASE ORDER 270920,pdf.zip
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:518'074 bytes
First seen:2020-09-29 12:42:21 UTC
Last seen:2020-09-29 13:31:13 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:e4gCPTDJeD6HmRzcuu7SB+EcKIR0jgN2A/7xByJfNwp2L4:eZCv0D6GRzS7SBzpIPN282+p2L4
TLSH E5B4235D6C6615817A345680723FC2E97ABB8F73810B31C539616E270B79EBF0678EE0
Reporter cocaman
Tags:RemcosRAT zip


Avatar
cocaman
Malicious email (T1566.001)
From: "<USA Lotterie > <info@abertax.com>"
Received: "from 162-241-204-248.unifiedlayer.com (unknown [162.241.204.248]) "
Date: "29 Sep 2020 06:29:57 -0700"
Subject: "GLUCKWUNSCHE!"
Attachment: "ABERTAX PURCHASE ORDER 270920,pdf.zip"

Intelligence

File Origin
# of uploads :
2
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.26176.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3a6da7e2c95852b644635b5ec5375a1736306b1c5bb3a8a0d82a13ecaf4cef8b/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-09-29 12:25:02 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hjw2pywjlbjlmrddlnpmkn22c43da2y4loz2rigyfij6zl2m56fq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Gamarue
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3a6da7e2c95852b644635b5ec5375a1736306b1c5bb3a8a0d82a13ecaf4cef8b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip 3a6da7e2c95852b644635b5ec5375a1736306b1c5bb3a8a0d82a13ecaf4cef8b

(this sample)

RemcosRAT

Executable exe 2edfccccc1152b413ba328644e11291bcf5d5c66078dc2f313469f328cd481b3

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2edfccccc1152b413ba328644e11291bcf5d5c66078dc2f313469f328cd481b3
  
Dropping
RemcosRAT

Comments