MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 950cafa2ebc4a1ab8e5c5d2316ec0d9607bdf87697808305c54be6377ef7d79c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 950cafa2ebc4a1ab8e5c5d2316ec0d9607bdf87697808305c54be6377ef7d79c
SHA3-384 hash: 9411fabc7ef499a5f50d755330cfc24c2b7d013314f437e8907037ed3f3d3c80e53c1f6cd9b6471bf4e1c8ae84218d4c
SHA1 hash: 81f35ec7487accf566a9a0c6ae86f6020cfffc9a
MD5 hash: d09dfeef783bfa040a0719a44ee76bc7
humanhash: pluto-sodium-orange-nitrogen
File name:Enquiries102.pdf.gz
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:813'816 bytes
First seen:2020-05-14 13:18:49 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 24576:RIr/KE2Bc+qfl7WYFfi3AnpXchd8H6bIbDNCB1x:Cr/KB897UeMrFbfBL
TLSH EE053386A5D01C751D0EBA2659810FF7575C173B1A32FE803DAE7468A48F78E123BA4F
Reporter abuse_ch
Tags:gz RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: host.infomaxtech.com
Sending IP: 107.6.9.9
From: David <accounting@transmedikspecialized.com>
Reply-To: accounting@transmedikspecialised.com
Subject: New Shipment Orders
Attachment: Enquiries102.pdf.gz (contains "sundayvibe.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Rescoms
Create hunting rule
Status:
Malicious
First seen:
2020-05-14 13:35:55 UTC
File Type:
Binary (Archive)
Extracted files:
94
AV detection:
19 of 47 (40.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sugk7ixlysq2xds4lurrn3ansyd336dws6aigbofjptdo7xx26oa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

gz 950cafa2ebc4a1ab8e5c5d2316ec0d9607bdf87697808305c54be6377ef7d79c

(this sample)

RemcosRAT

Executable exe 97dd79655e302fc504c36a27eef5b5bc385b42976b9db47c359e81d00eadecf8

  
Dropping
MD5 d4c5e919c5d6b1212aced1a5c9bb898c
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 97dd79655e302fc504c36a27eef5b5bc385b42976b9db47c359e81d00eadecf8

Comments