MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8bbe7ceda2f5babf11366bb03bcfdb2e3aed61c54e0ad11bd4395fb4a62b2ee2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8bbe7ceda2f5babf11366bb03bcfdb2e3aed61c54e0ad11bd4395fb4a62b2ee2
SHA3-384 hash: aeab12b88d613fb86f6f183947dd7e8966b078e643aad6187a5798f668aceb6fa4b012b76358734a16a2d07fcabd3882
SHA1 hash: e77791ddda553a7f306c7a345a04e1be6c2ddbb4
MD5 hash: 682e4687b74eed3e4e8b7e8e0cb73c4f
humanhash: winner-yellow-yellow-five
File name:PO 20191003.zip
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:808'529 bytes
First seen:2021-02-16 06:23:22 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:lhJ2fJSnXkFMok2xpc71iuD6JHQmX4IZqbyRLJgpIzIiFRoEFp7roE8G0yW9:Ec6FxIT+wROvRLJmITru39
TLSH 740533A486D59D39EC93DCD8A03B70D0C8B97B96B2547C68C22947F46840A5B91BBFF0
Reporter abuse_ch
Tags:RAT RemcosRAT zip


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: vps.helitactica.xyz
Sending IP: 203.159.80.22
From: office@kolsitegroups.com
Subject: Purchase Order 3401
Attachment: PO 20191003.zip (contains "PO 20191003.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
230
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Packed2.42845.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.23627.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8bbe7ceda2f5babf11366bb03bcfdb2e3aed61c54e0ad11bd4395fb4a62b2ee2/
Threat name:
ByteCode-MSIL.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-02-16 06:24:06 UTC
AV detection:
14 of 47 (29.79%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ro7hz3nc6w5l6ejwnoydxt63fy5o2yofjyfncg6uhfp3jjrlf3ra._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8bbe7ceda2f5babf11366bb03bcfdb2e3aed61c54e0ad11bd4395fb4a62b2ee2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip 8bbe7ceda2f5babf11366bb03bcfdb2e3aed61c54e0ad11bd4395fb4a62b2ee2

(this sample)

RemcosRAT

Executable exe b4ac6ef619dad164d5807395559ed299ce39cd5ec375aa86229d6617973a81fe

  
Dropping
MD5 32a1ba2a7e4f4bf2701fb75091ec6760
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b4ac6ef619dad164d5807395559ed299ce39cd5ec375aa86229d6617973a81fe

Comments