MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 86f0f15c9cebb50b276546864231b330c865f97e16f8a0d0b1cb791a78a0b715. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 86f0f15c9cebb50b276546864231b330c865f97e16f8a0d0b1cb791a78a0b715
SHA3-384 hash: dc0512cb987c7d5637e26915251886cc71b3624fbbb8ceb841184433bf31e26ca3929bef348c9e22c2a3bd7897910925
SHA1 hash: 6c0a8a9d179200c1cf9360fe75b44217a3dc520c
MD5 hash: ef6ffa3bc094afeb13a79349d3c57d95
humanhash: batman-king-purple-india
File name:P104627942.zip
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:276'682 bytes
First seen:2021-01-31 07:45:53 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:cljmO65Sm4F1OBB7G6WxLTw9n9p+9GuIiGUuSTQaR7SSDOQYZFWxa:MHpO9njZu4UuWpUHHh
TLSH 5B4423DB5D0536CE78C5903FAF37D99BE0B52B08059F85F141ADAB1E06B6348ADC02DA
Reporter abuse_ch
Tags:RAT RemcosRAT zip


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: slot0.helitactica.xyz
Sending IP: 203.159.80.22
From: Zein Akbar <zakbar@mcdermott.com>
Reply-To: Zein Akbar <parknet96@gmail.com>
Subject: Re: PO: P104627942; R01328518
Attachment: P104627942.zip (contains "P104627942.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
203
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/86f0f15c9cebb50b276546864231b330c865f97e16f8a0d0b1cb791a78a0b715/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-01-29 17:08:00 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=q3ypcxe45o2qwj3fi2deemntgdegl6l6c34kbufrzn4ru6faw4kq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/86f0f15c9cebb50b276546864231b330c865f97e16f8a0d0b1cb791a78a0b715

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip 86f0f15c9cebb50b276546864231b330c865f97e16f8a0d0b1cb791a78a0b715

(this sample)

RemcosRAT

Executable exe 327396e5d45963437ca911467811dd873249c8fd6c7cc06a5123517725b71154

  
Dropping
MD5 dd1ca4c9ddbd0a912ff3f350c3ce54c1
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 327396e5d45963437ca911467811dd873249c8fd6c7cc06a5123517725b71154

Comments