MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 879176de0fc707041c49d1b210bc50cccab058d31d01f3e9aa292a75fd45e916. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 879176de0fc707041c49d1b210bc50cccab058d31d01f3e9aa292a75fd45e916
SHA3-384 hash: e372f91a7182e2cafb2c145e2e917c419f35192c7b6ca83d17979752b6dcf043dd5c6404a14e056a7600f78271377c73
SHA1 hash: 6cea02c453294576f4380e8d218560bb04a5888a
MD5 hash: f4440b6f38b3e977aaf4f7a50ec88bcb
humanhash: lake-apart-winter-nine
File name:Factura Serfinanza_0165422957886_0654264_53541716602158910_127037_653196953409871463_69178299779.tgz
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:592'253 bytes
First seen:2020-12-17 08:37:44 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:GV12ekoikARa6WqUJ2RgBDM6M7PfLZ5xHt6+CfnnUslVn:UQej2a6/UJAGDM6M7XV3CfUS
TLSH B8C4332DAC9A4E6275A09EB8AC13A7176AFF5DC6C74674810C739CBD20F040167789FE
Reporter abuse_ch
Tags:Outlook RAT RemcosRAT tgz


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: NAM12-DM6-obe.outbound.protection.outlook.com
Sending IP: 40.92.22.30
From: Jhon William Pancha Romero <charlespublicidad@hotmail.com>
Subject: FACTURA EN MORA, REPORTE NEGATIVO EN DATACREDITO
Attachment: Factura Serfinanza_0165422957886_0654264_53541716602158910_127037_653196953409871463_69178299779.tgz (contains "Factura Serfinanza_0165422957886_0654264_53541716602158910_127037_653196953409871463_69178299779_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
112
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/879176de0fc707041c49d1b210bc50cccab058d31d01f3e9aa292a75fd45e916/
Threat name:
ByteCode-MSIL.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-12-17 08:38:08 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=q6ixnxqpy4dqihcj2gzbbpcqztflawgtdua7h2nkfevhl7kf5ela._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/879176de0fc707041c49d1b210bc50cccab058d31d01f3e9aa292a75fd45e916

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar 879176de0fc707041c49d1b210bc50cccab058d31d01f3e9aa292a75fd45e916

(this sample)

RemcosRAT

Executable exe bbdbb7ca68c199a7b030b900434d79f3fe59ab20fdb4ed910609fc5f91599c57

  
Dropping
MD5 424fe54dafd0ed8542f9419aece50a87
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bbdbb7ca68c199a7b030b900434d79f3fe59ab20fdb4ed910609fc5f91599c57

Comments