MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 41b30b18b8660497d1f2049b0bfa1dda7544b1102888f5821e245ffdd774da25. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 41b30b18b8660497d1f2049b0bfa1dda7544b1102888f5821e245ffdd774da25
SHA3-384 hash: 98516585686bc03d0340ecaf0a8ac01b487cb082489b50dd5edf808cfca876281ae68173391ab43fa89c397dc3f3a95e
SHA1 hash: e227426576c2a76a34451eddd6b1ac6cbdd758b5
MD5 hash: 62040034d65fa3db03c68de40ae8102f
humanhash: paris-mike-five-shade
File name:PO. MKL1-20-06053 TECHNICAL SPECIFICATION.rar
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:506'351 bytes
First seen:2021-01-11 18:36:39 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:sagx1SPRg50Bsn/7Hs8f00/Xm3daXF2+LC:sh1iq0Bsn/7H5r3F2+m
TLSH C0B423F6D5C94A2886D0E9FC6DF52121BCD8C2212E575F94194D8EB48BC9240C26BDEF
Reporter abuse_ch
Tags:rar RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: alhayatice.com
Sending IP: 212.83.46.26
From: Abhijeet P. Gade <mohsen@alhayatice.com>
Subject: PO MKL1-20-06053_WO_201065.
Attachment: PO. MKL1-20-06053 TECHNICAL SPECIFICATION.rar (contains "PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe")

RemcosRAT C2:
212.83.46.26:4023

Intelligence

File Origin
# of uploads :
1
# of downloads :
159
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/41b30b18b8660497d1f2049b0bfa1dda7544b1102888f5821e245ffdd774da25/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-01-11 18:37:05 UTC
AV detection:
15 of 44 (34.09%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=igzqwgfymycjpupsasnqx6q53j2ujmiqfceplaq6erp73v3u3isq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/41b30b18b8660497d1f2049b0bfa1dda7544b1102888f5821e245ffdd774da25

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar 41b30b18b8660497d1f2049b0bfa1dda7544b1102888f5821e245ffdd774da25

(this sample)

RemcosRAT

Executable exe 6a2ffd2b362dd38d2518163bd6c849366ab37d38a446845cc9789dcd02f8e7db

  
Dropping
MD5 81338cc1ec365407ac22a6eab3ece373
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6a2ffd2b362dd38d2518163bd6c849366ab37d38a446845cc9789dcd02f8e7db

Comments