MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7aaade532d3954b27104c86c06f84c2abc0dcf5a48bdbf30198bf240a481f12d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7aaade532d3954b27104c86c06f84c2abc0dcf5a48bdbf30198bf240a481f12d
SHA3-384 hash: 53e091ac3f79ea0367dd1d596343b5223a389d23fff4207c08e24332a9c007c4c6f60d5384f53e70a04b3291bee53730
SHA1 hash: c7aee815b86fe3a32cbfb03466134f4d40bf2989
MD5 hash: 6029b2d234151e4761ee2e5e37ee988b
humanhash: pip-floor-hot-tango
File name:PurchaseOrder1026.gz
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:398'661 bytes
First seen:2020-10-26 14:32:08 UTC
Last seen:2020-10-28 06:57:20 UTC
File type: gz
MIME type:application/x-rar
ssdeep 12288:dbCXm3GHHJcyTLTo1GCAfwqie+iMbKGJe/:dbC26pcevgqiNiAm
TLSH 298423F7097714E0696BBA124CCAE80DC7C9118DBEC4C41BB444E807596AFEDEA8C56F
Reporter abuse_ch
Tags:gz RemcosRAT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: gmail.com
Sending IP: 37.49.225.237
From: Ensar ÖZSERDAR <cdy3079@gmail.com>
Subject: Purchase Order 1126
Attachment: PurchaseOrder1026.gz (contains "PurchaseOrder1026.exe")

Intelligence

File Origin
# of uploads :
8
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7aaade532d3954b27104c86c06f84c2abc0dcf5a48bdbf30198bf240a481f12d/
Threat name:
Win32.Backdoor.NetWiredRc
Create hunting rule
Status:
Malicious
First seen:
2020-10-26 06:50:38 UTC
File Type:
Binary (Archive)
Extracted files:
59
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pkvn4uznhfkle4iezbwan6cmfk6a3t22jc636mazrpzebjeb6ewq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

gz 7aaade532d3954b27104c86c06f84c2abc0dcf5a48bdbf30198bf240a481f12d

(this sample)

RemcosRAT

Executable exe a91a4674f844f5aa50396270e294341cbb2f87dbc5c9fc29d832efa2234eb9e9

  
Dropping
MD5 21c582d4c4dd6702236f724f97ad4aa6
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a91a4674f844f5aa50396270e294341cbb2f87dbc5c9fc29d832efa2234eb9e9

Comments