MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5231bb04e4fe0a1e36fd4b94f31a761460ab4eea4abf85edef62d8d33e172efc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5231bb04e4fe0a1e36fd4b94f31a761460ab4eea4abf85edef62d8d33e172efc
SHA3-384 hash: a0e7a356be7165303c7aa2cb4a0f5fcf9d8d00fa769d26a9c6ce43fbbc98f0e6ecdc1d2eeb489264218ffad495dd45b9
SHA1 hash: f6b7a1717014863e928a6b0a8429d0d20b80e6e2
MD5 hash: b466030d6e23728f300f62c71054e238
humanhash: spring-november-west-louisiana
File name:ADJUNTO_EXTRACTO_8480077866388612005935_483837068728927904754625846_641381686385369272964540_0047083
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:545'334 bytes
First seen:2020-11-26 06:41:12 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:r+ek7q9nzJP9s8uoPMjqxYf34bP6gOsJDnBY8PC9+Eri8130y2e:S3UJ9uoU2GfIbvDBRPC9/j13N2e
TLSH 13C4231C6AD00EE773A290B5C53824CB6E6736DF4A52B79938B0DF2E5C25839128CF5D
Reporter abuse_ch
Tags:Outlook RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: NAM11-CO1-obe.outbound.protection.outlook.com
Sending IP: 40.92.18.74
From: info. Extracto <electromacltda58@outlook.es>
Subject: EXTRACTO SERFINANZA.
Attachment: ADJUNTO_EXTRACTO_8480077866388612005935_483837068728927904754625846_641381686385369272964540_0047083 (contains "ADJUNTO_EXTRACTO_8480077866388612005935_483837068728927904754625846_641381686385369272964540_0047083647940737112691_pdf.exe")

RemcosRAT C2:
databasepropersonombrecomercialideasearchwords.services:7580 (186.169.81.240)

Intelligence

File Origin
# of uploads :
1
# of downloads :
117
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5231bb04e4fe0a1e36fd4b94f31a761460ab4eea4abf85edef62d8d33e172efc/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kiy3wbhe7yfb4nx5jokpggtwcrqkwtxkjk7yl3ppmlmngpqxf36a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar 5231bb04e4fe0a1e36fd4b94f31a761460ab4eea4abf85edef62d8d33e172efc

(this sample)

RemcosRAT

Executable exe 843326e8aabda8025975ae55e6d36fcd8bb79e2e1a5f25e86303b82f16c3bac5

  
Dropping
MD5 e599328c1b6b637ebc83d153de159d26
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 843326e8aabda8025975ae55e6d36fcd8bb79e2e1a5f25e86303b82f16c3bac5

Comments