MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 76869a30bbdf21b0d47076ff7d55a0c38a892a22b737f24a4872848f3da2ba5f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 76869a30bbdf21b0d47076ff7d55a0c38a892a22b737f24a4872848f3da2ba5f
SHA3-384 hash: 565e5fac29e2064fd46fbcad0192726e5d5e53ec0475527ffc0914fc996ca0afd1d3f78c9749bebe54c7f8a959e364ad
SHA1 hash: aaead1fefb50b06679951dbfbe15a0dbb248680b
MD5 hash: 75290c73045fa806c6e591060015671b
humanhash: pip-iowa-diet-football
File name:Payment-101920.gz
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:368'963 bytes
First seen:2020-10-19 18:09:36 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:h7Kw6kZuUVEQcD7npn/Fxo3VCJbmMe/zt7OFO5EelPk1Ox8oU9gJEFd:hh6kZHVEQkdxolCJ9e/N4yhtw3Fd
TLSH 4F7423CB0671388762ED663FCC5B10416C5393E9BCFDE86C4AC656972BFC22960D206A
Reporter abuse_ch
Tags:gz RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: gmail.com
Sending IP: 37.49.225.237
From: Office <cdy3079@gmail.com>
Subject: Payment 10-19-2020
Attachment: Payment-101920.gz (contains "Payment-101920.exe")

RemcosRAT C2:
185.165.153.243:2021

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/76869a30bbdf21b0d47076ff7d55a0c38a892a22b737f24a4872848f3da2ba5f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-19 13:33:58 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=o2djumf334q3bvdqo37x2vnayofiskrcw437essiokci6pncxjpq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/76869a30bbdf21b0d47076ff7d55a0c38a892a22b737f24a4872848f3da2ba5f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

gz 76869a30bbdf21b0d47076ff7d55a0c38a892a22b737f24a4872848f3da2ba5f

(this sample)

RemcosRAT

Executable exe 5ea758baddc8ee59eae86bdf492b597aec1c861115519357d3697f91f610c73c

  
Dropping
MD5 e7c9bad8e2757e9c35fbc9c461dc9280
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5ea758baddc8ee59eae86bdf492b597aec1c861115519357d3697f91f610c73c

Comments