MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 48b46abd908e4e695894426b57c5e4d99aaaa8823b2d7d30d4294a099f99a438. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 48b46abd908e4e695894426b57c5e4d99aaaa8823b2d7d30d4294a099f99a438
SHA3-384 hash: 4319d7d811d85281f03c62a38514e338018896009e90f82dcfc6996d30c4d5aa1692327a01e195c3a01d026a8edb64c9
SHA1 hash: 5c5c0de28ea8e125ccb65ed475ffec24274a7983
MD5 hash: aff32b62bd8e9fc85f3289e590a0630e
humanhash: batman-florida-failed-ceiling
File name:DOC_ECS9522020102615040053_5778_952.rar
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:214'159 bytes
First seen:2020-10-27 10:26:04 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:iNVYQ5g8PTYCF1Ynv3ZL+wktZfrznejHS5XSA7:iNR3rJ1oPZVaFrTSHShR
TLSH C3241274E130476A4AA643BC683B7EB2D90CAFF8C521917638DC4FA4BD63481376E16D
Reporter abuse_ch
Tags:rar RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: mailserver.euroslotpars.com
Sending IP: 198.50.206.180
From: Sydler packs<del6@gsicargo.com>
Subject: Re: Payment Advise
Attachment: DOC_ECS9522020102615040053_5778_952.rar (contains "DOC_ECS9522020102615040053_5778_952.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.RarMal-C.7312.28626.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/48b46abd908e4e695894426b57c5e4d99aaaa8823b2d7d30d4294a099f99a438/
Threat name:
ByteCode-MSIL.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-10-27 04:37:13 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jc2gvpmqrzhgsweuijvvprpe3gnkvkechmwx2mgufffath4zuq4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar 48b46abd908e4e695894426b57c5e4d99aaaa8823b2d7d30d4294a099f99a438

(this sample)

RemcosRAT

Executable exe cb4567c5c6b82e5de38e47ac7047d3d7d072d3b235ff537090ee5d96fcf1e22b

  
Dropping
MD5 891d42aa07046303cc7745a73882dd8d
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cb4567c5c6b82e5de38e47ac7047d3d7d072d3b235ff537090ee5d96fcf1e22b

Comments