MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6dd6be81fda77c627a349e76cecd4eb6b6926166259fc157e0b4d8d9a230f63a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6dd6be81fda77c627a349e76cecd4eb6b6926166259fc157e0b4d8d9a230f63a
SHA3-384 hash: 4e1864d299d2552454d4981148f106eba8cfa7aff0bcc21658d90fcf4fc9065a17710323fddaa2aaeacda9382b8b42be
SHA1 hash: 0cdf2eb2139146a88ce45ede9e33973c6caf09d3
MD5 hash: 4b62749ff3bb24bc4b3d177d05518357
humanhash: saturn-high-avocado-asparagus
File name:SWIFT COPY PRINTOUT.zip
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:972'415 bytes
First seen:2020-10-25 06:43:38 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:245aJAa9UuiQY7zPvJ4bc0Rm9KLgxNKPSi7DmS5TgsSr6ytXHC4TtYt9/8RljEaj:lKAJH3Ac6m9qgxNw+wTyhGtuj0Fq
TLSH C52533A461F1C7A53A2E86D33D36BA6B78F9911DDC203E5E235D4258CDDDBF1BA00A10
Reporter abuse_ch
Tags:RAT RemcosRAT zip


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: monolithicpower.com
Sending IP: 66.154.112.152
From: Li<Ethan.Li@monolithicpower.com>
Subject: RE CONFIRM THE BANK ACCOUNT DETAILS FOR PAYMENT
Attachment: SWIFT COPY PRINTOUT.zip (contains "SWIFT COPY PRINTOUT.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis62EE98DDCAE2.8322.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6dd6be81fda77c627a349e76cecd4eb6b6926166259fc157e0b4d8d9a230f63a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-24 20:41:30 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nxll5ap5u56ge6rutz3m5tkow23jeylgewp4cv7awtmntirq6y5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6dd6be81fda77c627a349e76cecd4eb6b6926166259fc157e0b4d8d9a230f63a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip 6dd6be81fda77c627a349e76cecd4eb6b6926166259fc157e0b4d8d9a230f63a

(this sample)

RemcosRAT

Executable exe 5337515e504672e7c397c5d2fd9dc7d95fa4dcbfa85eba44ff42df7acf2fb8d2

  
Dropping
MD5 62ee98ddcae228b6e5fe1e7721b0a78c
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5337515e504672e7c397c5d2fd9dc7d95fa4dcbfa85eba44ff42df7acf2fb8d2

Comments