MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4b29300b3d7fa36cd387ba090aac866de032bce4453505e3192cffcadf07bd3a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4b29300b3d7fa36cd387ba090aac866de032bce4453505e3192cffcadf07bd3a
SHA3-384 hash: 55b53ecd9cfdb3d3f6d06a3df88c8c4c48d82086ac2c046a1125485e9fe994fa783090e1cbf1174cf082a1f4d70f9434
SHA1 hash: 36656c848c25dd32fbfd3533612caa92fb69479b
MD5 hash: c7a059f301c4ab85efd2e4dbedde87be
humanhash: steak-oxygen-burger-hotel
File name:BANK DETAILS_pdf_____________________________.gz
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:964'480 bytes
First seen:2021-08-19 05:19:14 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 24576:5o3vXpHajrzP4PLlQUnYWnRbzWZBVaWFPSj/HV7ji/xU7sPGN:5emvP5UnYW1zWTVaWoj/1PqU7sON
TLSH T1502533743C9A521366B98C4EB7DE407F909239D5FBDB64DB5429B008730EAE344B3A6C
Reporter fabjer
Tags:gz RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
124
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4b29300b3d7fa36cd387ba090aac866de032bce4453505e3192cffcadf07bd3a/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-08-18 19:30:27 UTC
AV detection:
12 of 28 (42.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jmutacz5p6rwzu4hxieqvlegnxqdfpheiu2qlyyzft74vxyhxu5a._file
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:good rat
Link:
https://tria.ge/reports/210819-72b3yjjwh2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Remcos
Malware Config
C2 Extraction:
trucker5.ddns.net:3341
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.95
Link:
https://yomi.yoroi.company/submissions/4b29300b3d7fa36cd387ba090aac866de032bce4453505e3192cffcadf07bd3a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

gz 4b29300b3d7fa36cd387ba090aac866de032bce4453505e3192cffcadf07bd3a

(this sample)

RemcosRAT

Executable exe 21624d6c424d30339e8c2719402694e64e4d056ce6526870fea4ebf2062735a3

  
Dropping
SHA256 21624d6c424d30339e8c2719402694e64e4d056ce6526870fea4ebf2062735a3
  
Delivery method
Distributed via e-mail attachment

Comments