MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 97b565489c8b902e2be9da9076562cf7e7dedfe1611c7a15e2db59fc46c4d307. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 97b565489c8b902e2be9da9076562cf7e7dedfe1611c7a15e2db59fc46c4d307
SHA3-384 hash: b62f775160e853e890d63421aed27a7adf7b3a8b77135df919c7202824c3eaf14eaac5ad0c692411e8406b616a14b0ed
SHA1 hash: d202b8606a96f9207c0ee60cf5714d2023ec9fe5
MD5 hash: b1a79c930f3d7ca74a9f9dba50fdf9df
humanhash: oranges-kitten-beryllium-skylark
File name:Factura Serfinanza_06888639945_84691_7738990892730_52890999_41886922051901092896848_378299483573.tgz
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:582'923 bytes
First seen:2020-12-17 09:05:47 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:p6ljYuVAH0syMgoBxlq0C8IBbGEbJ5aRvTzcMXDSVg+/HYsVVIFSv:pSjYGM0ggSahNGEbJfMT7IRv
TLSH 73C423E0695BA139B4A6F04C43EB9BD25C488FFD914A2AED7F5F8515802C2B42F72F11
Reporter abuse_ch
Tags:Outlook RAT RemcosRAT tgz


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: NAM11-CO1-obe.outbound.protection.outlook.com
Sending IP: 40.92.18.73
From: RUBIELA RIVERA <estacionelchorro@hotmail.com>
Subject: FACTURA EN MORA SERFINANZA.
Attachment: Factura Serfinanza_06888639945_84691_7738990892730_52890999_41886922051901092896848_378299483573.tgz (contains "Factura Serfinanza_06888639945_84691_7738990892730_52890999_41886922051901092896848_378299483573_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
194
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.DrodRar-A.22474.4587.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/97b565489c8b902e2be9da9076562cf7e7dedfe1611c7a15e2db59fc46c4d307/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=s62wkse4roic4k7j3kihmvrm67t55x7bmeohufpc3nm7yrwe2mdq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/97b565489c8b902e2be9da9076562cf7e7dedfe1611c7a15e2db59fc46c4d307

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar 97b565489c8b902e2be9da9076562cf7e7dedfe1611c7a15e2db59fc46c4d307

(this sample)

RemcosRAT

Executable exe 56369cd0a8b7843a6e6c9bef3de71498a19c4e4be23cacb868b8ec1d21286f36

  
Dropping
MD5 ff81ebb0ea87e9b03fe10946067f55f2
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 56369cd0a8b7843a6e6c9bef3de71498a19c4e4be23cacb868b8ec1d21286f36

Comments