MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5cf2802d2b47a4c7bd44ecb9a814ded6cb14eef89d8551bdc5ac17d86081633a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5cf2802d2b47a4c7bd44ecb9a814ded6cb14eef89d8551bdc5ac17d86081633a
SHA3-384 hash: a8e5f72dd403bc31b1257b63be34f6709a4a0940192ff31a917fbcd47d585c129411ed2cfea662dd28a4fc8b3c280a28
SHA1 hash: ba96eeae7bc66c74358bd9bcf79c5bff532b177a
MD5 hash: 7ab7e5712a30156693533ca131146851
humanhash: aspen-blue-eleven-california
File name:ADJUNTO_EXTRACTO_6304436413791777271886_119133286117580343742032861_149881796216827597734120_3235296
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:622'239 bytes
First seen:2020-11-26 06:52:06 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:2E3sqHZAeU+bw94cEFGFm++2+5PH9rRHwEvkJCLLFwo4WpII8Y+EQPd6Mi27gCWS:V5ygDFGIB2+5PHDQvJwN+EQP0MNPWIrp
TLSH 48D42374476C71EE8376BB00FB8D442505D01C59AA17266263CFECCFE8428A9157BADF
Reporter abuse_ch
Tags:Outlook RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: NAM02-CY1-obe.outbound.protection.outlook.com
Sending IP: 40.92.4.52
From: info. Extracto <electromacltda55@outlook.es>
Subject: EXTRACTO SERFINANZA.
Attachment: ADJUNTO_EXTRACTO_6304436413791777271886_119133286117580343742032861_149881796216827597734120_3235296 (contains "ADJUNTO_EXTRACTO_6304436413791777271886_119133286117580343742032861_149881796216827597734120_3235296466249137363112_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
129
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5cf2802d2b47a4c7bd44ecb9a814ded6cb14eef89d8551bdc5ac17d86081633a/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ltzialjli6smppke5s42qfg623frj3xytwcvdpofvql5qyebmm5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar 5cf2802d2b47a4c7bd44ecb9a814ded6cb14eef89d8551bdc5ac17d86081633a

(this sample)

RemcosRAT

Executable exe 7ae5ac27e29e826ac3a5e407f1f760aa6d239e8de85280886adc7bc4113cace0

  
Dropping
MD5 eea563299caef713fadc6d4364a2ea9d
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7ae5ac27e29e826ac3a5e407f1f760aa6d239e8de85280886adc7bc4113cace0

Comments