MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 853ec08028ffaba08b6f2f3f6b222f7695dd02b6a81bcbb5673f7ac1289513b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 853ec08028ffaba08b6f2f3f6b222f7695dd02b6a81bcbb5673f7ac1289513b9
SHA3-384 hash: 4d3e32b84d65f793c0370fec36219c4a4743f0ff3f39ef2b80598db41d70d06b08f5b896e781e58ec21c3411248ee871
SHA1 hash: f6cc29063df44c8fef22ff16452594721e6a74f3
MD5 hash: cbe4016bb46db65886899c497d97965b
humanhash: coffee-two-delaware-white
File name:Scan.ace
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:142'020 bytes
First seen:2020-06-15 07:09:37 UTC
Last seen:Never
File type: ace
MIME type:application/octet-stream
ssdeep 3072:v/JJU0azVINUaaxihgin+npVN0wPP+IeDVPvZlTuR1O7N6QEd:s0azOHhpK0wPP+BxrxQ
TLSH CFD3123A122F3BFEC990894BE538563EC09D488720A3C385F945E63973E57466D1387A
Reporter jarumlus

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 05:10:18 UTC
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

ace 853ec08028ffaba08b6f2f3f6b222f7695dd02b6a81bcbb5673f7ac1289513b9

(this sample)

RemcosRAT

Executable exe dfa62653c2606c14be6b244fdc19c07c2d31fe4553f2cebba08c972e92f27434

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dfa62653c2606c14be6b244fdc19c07c2d31fe4553f2cebba08c972e92f27434
  
Dropping
MD5 2e3c900b4bebe6456c4ebb313abc7fa8

Comments