MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8324f90d2d4e187f2ed442a89f22d1fd4ef93dc48e8b0fa2850451676e430975. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8324f90d2d4e187f2ed442a89f22d1fd4ef93dc48e8b0fa2850451676e430975
SHA3-384 hash: 9184f205e52d95588ce3d13ea74a530409fd9ce361044c2225a00875eb8a4062f4a3fdb2ab1376f697b63ee17862b4e8
SHA1 hash: 662f795443531f7fc2dc81a70c4de19a885b4ac2
MD5 hash: 99471551df97faacc726d6d05fb477c3
humanhash: grey-maine-undress-undress
File name:POEA DELISTED AGENCIES BATCH A.uue
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:470'229 bytes
First seen:2021-02-18 07:39:46 UTC
Last seen:Never
File type: uue
MIME type:application/x-rar
ssdeep 12288:0eAqFM9nhADdcS0+d1zqTpers2QLX8MLp/UAXjF5jFzlx:tAqOnhADWS021zqTEQBQksAzF5j5
TLSH 77A423674862FC57B781851BF58F071DCA139868D65ECBC8EE4F7CA226F021C57A9318
Reporter abuse_ch
Tags:geo PHL POEA RAT RemcosRAT uue


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: sd.latticesystems.com
Sending IP: 204.152.206.90
From: Philippine Overseas Employment Administration <info1@poea.gov.ph>
Subject: POEA ADVISORY NO 450 2021
Attachment: POEA DELISTED AGENCIES BATCH A.uue (contains "POEA DELISTED AGENCIES (BATCH A).PDF.exe")

RemcosRAT C2:
shahzad73.casacam.net:2404

Intelligence

File Origin
# of uploads :
1
# of downloads :
148
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8324f90d2d4e187f2ed442a89f22d1fd4ef93dc48e8b0fa2850451676e430975/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-18 07:40:09 UTC
AV detection:
8 of 47 (17.02%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qmspsdjnjymh6lwuikuj6iwr7vhpspoer2fq7iufariwo3sdbf2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8324f90d2d4e187f2ed442a89f22d1fd4ef93dc48e8b0fa2850451676e430975

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

uue 8324f90d2d4e187f2ed442a89f22d1fd4ef93dc48e8b0fa2850451676e430975

(this sample)

RemcosRAT

Executable exe 0bfae38c37f8478cfd4c92f603b202f8f4bff11f96fdce5959eeaad5142d9a3a

  
Dropping
MD5 217179aac1ed3994614e7c8666d2f82b
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0bfae38c37f8478cfd4c92f603b202f8f4bff11f96fdce5959eeaad5142d9a3a

Comments