MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 3f937c7dddcdc31780807b68e4b93eea42d4146195b9c45d671bf6ed2f52a5bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RemcosRAT
Vendor detections: 7
| SHA256 hash: | 3f937c7dddcdc31780807b68e4b93eea42d4146195b9c45d671bf6ed2f52a5bc |
|---|---|
| SHA3-384 hash: | e326b4bd9aba2a1943641fe4e6b5bd24a30543a1775c2db93a95811a603a3ef3db14e4785561829d0553f9151fd6ab1b |
| SHA1 hash: | cef1e792bbd5049e7a15d97d93258ab01e077e72 |
| MD5 hash: | ad05f0c477b38274558768134e4253ff |
| humanhash: | jersey-nevada-green-alaska |
| File name: | Paid Approval_ Quote_PDF_99998737t3838799998765635678_76378783773663638822.exe |
| Download: | download sample |
| Signature | RemcosRAT |
| File size: | 1'711'254 bytes |
| First seen: | 2020-08-18 12:55:10 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 1d3807efc70a0a5a6d2ab497250e9cb5 (4 x RemcosRAT, 1 x AZORult, 1 x AveMariaRAT) |
| ssdeep | 24576:5m/TyzPWwuUDpoEwECcKpkON/0no0VhtuMN0BnT1qZwXh/xhR3PKiFdqVOjZU0Jv:EExXE0no0Vhd0BnxqS1RUVAZoHaIM |
| Threatray | 314 similar samples on MalwareBazaar |
| TLSH | 9885D026F2C1F63EC3FA4AF49CA96F845925FE4023409C8B62F63D59C936A40F5D3259 |
| Reporter |  abuse_ch |
| Tags: | exe RemcosRAT |
abuse_ch
Malspam distributing unidentified malware:HELO: rdns1.iplumpo.xyz
Sending IP: 51.210.21.231
From: noreply@paystores.com
Subject: RE: Quote - Approval AT635528 Paid
Attachment: Paid Approval_ Quote_PDF_99998737t3838799998765635678_76378783773663638822.rar (contains "Paid Approval_ Quote_PDF_99998737t3838799998765635678_76378783773663638822.exe")
Intelligence
File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a UDP request
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Creating a file
Launching a process
Running batch commands
Creating a process with a hidden window
Threat name:
Win32.Trojan.Delf
Status:
Malicious
First seen:
2020-08-18 12:57:05 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 304 additional samples on MalwareBazaar
Result
Malware family:
remcos
Score:
10/10
Tags:
persistence rat family:remcos
Behaviour
Modifies registry key
Modifies system certificate store
Suspicious use of WriteProcessMemory
Adds Run key to start application
Remcos
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Cryptor
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.