MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7633a968b48b13b4ca41bc4de1ba3054843f051f58ea3af875979e8306c0068f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7633a968b48b13b4ca41bc4de1ba3054843f051f58ea3af875979e8306c0068f
SHA3-384 hash: 75b94b49970dc8e0fbbe7a7757e65056a74ef4d3dbe3274bbfe1b0ef62ae2b76a035e70f2dd4c7fc6ef5d3fa9149c1b9
SHA1 hash: 90f4e7f700c7475f9461d51880ad510735b5ca79
MD5 hash: 7d21a3a91cdce43998d8ac0845490f34
humanhash: burger-finch-speaker-pizza
File name:Ordine_PEKOR_1020.rar
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:341'373 bytes
First seen:2020-10-20 08:04:42 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:nTxjdufHVQSSIKRIUEB+Yhlv0Aq/Q3MDX4Qi5qehiiFaCxm7BlOOy0H:nTxJAHpbKOUf2qoII9EeoiF9y/OuH
TLSH B6742319F95DC51EBDCE2B43A3649008DF56900FD7A91E3E4C394A51A898AD2DE1FCB0
Reporter abuse_ch
Tags:rar RemcosRAT


Avatar
abuse_ch
Malspam distributing unidentified malware:

From: "pekor@t.mk" <pekor@t.mk>
Subject: Nuovo ordine ottobre
Attachment: Ordine_PEKOR_1020.rar (contains "Ordine_PEKOR_1020.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7633a968b48b13b4ca41bc4de1ba3054843f051f58ea3af875979e8306c0068f/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-10-20 08:06:04 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oyz2s2furmj3jssbxrg6dorqkscd6bi7ldvdv6dvs6pigbwaa2hq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/7633a968b48b13b4ca41bc4de1ba3054843f051f58ea3af875979e8306c0068f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar 7633a968b48b13b4ca41bc4de1ba3054843f051f58ea3af875979e8306c0068f

(this sample)

RemcosRAT

Executable exe 0fac83472e461604cdb195068ca091af7c56d39c73794fa41394206e1ede2894

  
Dropping
MD5 231442cee42f591f495edf68551d5e26
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0fac83472e461604cdb195068ca091af7c56d39c73794fa41394206e1ede2894

Comments