MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4b712b76c5e9dc67f2331a4be07a71e4e3fbc1d3793e33a380fba73bd3b6cba5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4b712b76c5e9dc67f2331a4be07a71e4e3fbc1d3793e33a380fba73bd3b6cba5
SHA3-384 hash: 08e5cd00687bbbd50613907a58b616faee16a552e969181dc3066085e1db27f47f51c26e81ce5d8b67b0066e6074e379
SHA1 hash: 980b1dc3de54ab0769b45e9ae1357658550bc265
MD5 hash: 58c346ecae1a3b957a55ceae7b1e3f4f
humanhash: virginia-november-texas-vermont
File name:Scan_ 11 Feb 2021 at 1.25_Bz5543_PDF.img
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'245'184 bytes
First seen:2021-02-11 07:57:33 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:epzfwkD3Ay5KvCRN4DseufcoksBuu5XX9Okv2M+u2tJ6GJeL:gfwg5Kg2UfcoH5XNOkHGAL
TLSH BF45E0277B3009D1F2980A7CD1C1058C17726D76B949D758AC8C2587CFE4EB8DB7ABA2
Reporter abuse_ch
Tags:img RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: srv01.walbix.com
Sending IP: 91.142.210.174
From: "The Hongkong and Shanghai Banking Corporation Limited (HSBC)" <customerservice@hsbc.com.hk>
Subject: Re: 回复： Bank Transfer Notification
Attachment: Scan_ 11 Feb 2021 at 1.25_Bz5543_PDF.img (contains "Scan_ 11 Feb 2021 at 1.25_Bz5543_PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs1756.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4b712b76c5e9dc67f2331a4be07a71e4e3fbc1d3793e33a380fba73bd3b6cba5/
Threat name:
ByteCode-MSIL.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-02-11 08:42:38 UTC
AV detection:
10 of 47 (21.28%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jnysw5wf5hogp4rtdjf6a6tr4tr7xqotpe7dhi4a7ottxu5wzosq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4b712b76c5e9dc67f2331a4be07a71e4e3fbc1d3793e33a380fba73bd3b6cba5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

img 4b712b76c5e9dc67f2331a4be07a71e4e3fbc1d3793e33a380fba73bd3b6cba5

(this sample)

RemcosRAT

Executable exe 5527aee4e45fad012be08beb8622e0471286523fa3abb1719d1f71deedf323eb

  
Dropping
MD5 710e14d7edf8bd04d79e8fd424fce842
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5527aee4e45fad012be08beb8622e0471286523fa3abb1719d1f71deedf323eb

Comments