MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 66aac6fa0b2f3429f75a7e3a833485d9671a098c162982f7366229b08c110f5b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 66aac6fa0b2f3429f75a7e3a833485d9671a098c162982f7366229b08c110f5b
SHA3-384 hash: 9a75cb3496ce94452705810825a36a100819099fa9fab35a584f43e3539d27e3148f3b516c6d34115d08901907f777c4
SHA1 hash: 6959693effc27f2c9d2109de53a1b6bd7dd64140
MD5 hash: 2f5fe29ddf885d79b443b94f1f65c058
humanhash: sixteen-alanine-potato-alpha
File name:New inquiry CON 20-10630.zip
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:287'851 bytes
First seen:2021-01-11 18:36:50 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:4Us2+bHkeftY4WLfhiLzluqFW1qTpGt82XBiSWIimgxiWAoTQaSQG92t:4p2wH3ftehiH4KwqYu2RDWIlAJThG92t
TLSH 9154236DEA7DDBCD2D41ACAEC35911CB52B42309C3FC593C94EC584348CA4B6E07A95A
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail0.banamexbank.com
Sending IP: 128.199.141.37
From: Jarrie Lau (刘永山) <sales@banamexbank.com>
Subject: New inquiry / Offer CON 20-10630
Attachment: New inquiry CON 20-10630.zip (contains "New inquiry CON 20-10630.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
152
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs2262.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/66aac6fa0b2f3429f75a7e3a833485d9671a098c162982f7366229b08c110f5b/
Threat name:
Win32.Spyware.AveMaria
Create hunting rule
Status:
Malicious
First seen:
2021-01-11 10:43:33 UTC
AV detection:
10 of 28 (35.71%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=m2vmn6qlf42ct522py5ignef3ftrucmmcyuyf5zwmiu3bdarb5nq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/66aac6fa0b2f3429f75a7e3a833485d9671a098c162982f7366229b08c110f5b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip 66aac6fa0b2f3429f75a7e3a833485d9671a098c162982f7366229b08c110f5b

(this sample)

RemcosRAT

Executable exe 82d86565a1d25c4d51dd3c61b58594769bbdacc7e56baf2d5441f4f8dc36b225

  
Dropping
MD5 81b6d0ccb04d637c5d3531c5db05581e
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 82d86565a1d25c4d51dd3c61b58594769bbdacc7e56baf2d5441f4f8dc36b225

Comments