MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4682a57786cd783f5d88c3c9a0def62eca8655eef3046471126a16826c9b567b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4682a57786cd783f5d88c3c9a0def62eca8655eef3046471126a16826c9b567b
SHA3-384 hash: 4ec8862ff1868e4cfbf48fdc5496529cdc789ef4066fddd28f25b3f85a4725caddae97264ee48a5216932eda10bb34fd
SHA1 hash: 5842a352d9a2607371a311957190a11b927d8eb5
MD5 hash: 2bdc2b8d7ec27f0c5275e8aa79bf32fa
humanhash: bravo-lima-beryllium-early
File name:Cobro Juridico_08488786443_3691572_194632407966235_6136920_55536685115578730658_3718623235.tgz
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:593'574 bytes
First seen:2020-11-20 07:55:32 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:KM41qW9P1w27CMoDsvYcu8puhPKSS0JcptC8LJp3uk7Oj70YijAFaOPZiNl+A/:KM41qWRJmXDYYL88RJcptC8tYSNl+A/
TLSH CEC423F9A14DE39DEF2E6C19E224ECFC5B20A37138027F57249E919D08A3838F547599
Reporter abuse_ch
Tags:Outlook RAT RemcosRAT tgz


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: NAM10-BN7-obe.outbound.protection.outlook.com
Sending IP: 40.92.40.94
From: gabriel arango hernandez <gabrielarangohernandez@hotmail.com>
Subject: COBRO JURIDICO SERFINANZA.
Attachment: Cobro Juridico_08488786443_3691572_194632407966235_6136920_55536685115578730658_3718623235.tgz (contains "Cobro Juridico_08488786443_3691572_194632407966235_6136920_55536685115578730658_3718623235_pdf.exe")

RemcosRAT C2:
databasepropersonombrecomercialideasearchwords.services:7580 (186.169.53.6)

Intelligence

File Origin
# of uploads :
1
# of downloads :
134
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4682a57786cd783f5d88c3c9a0def62eca8655eef3046471126a16826c9b567b/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=i2bkk54gzv4d6xmiype2bxxwf3fimvpo6mcgi4isnilie3e3kz5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar 4682a57786cd783f5d88c3c9a0def62eca8655eef3046471126a16826c9b567b

(this sample)

RemcosRAT

Executable exe 4a94b062dbb9df940520146d100df5b019795d0f508d7ba89d24eb18725e1608

  
Dropping
MD5 dd1d460392017ea2bb0ab4a5526ab0a4
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4a94b062dbb9df940520146d100df5b019795d0f508d7ba89d24eb18725e1608

Comments