🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9b2f0fcf047e79588f1839e4ddc169abd6fadeae3ef20ce2132a7a64d6ffd297. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9b2f0fcf047e79588f1839e4ddc169abd6fadeae3ef20ce2132a7a64d6ffd297
SHA3-384 hash: 6fe28771bc5f88a95cf340792e444ea5e13e9002f2819a0ecc4374ca2b446ce01951eb22c53eccac19d1edf71579e1f8
SHA1 hash: 642e9d2bbe644dcc8879ee86cafe06842da32de3
MD5 hash: ac6df0e5ae1d3c9863b7fd5e832924cb
humanhash: dakota-mountain-low-football
File name:Demanda Civil-PDF.rar
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:531'838 bytes
First seen:2022-10-26 13:55:10 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
Note:This file is a password protected archive. The password is: 1234
ssdeep 12288:3FDKoeSZJH6fqd5xKkZJhxRvb1jg1VkHVT2a7kwlmbV+y:ooeaJafq3xKi/vblg1Vk1T2aLmF
TLSH T13AB4236D2E65415F9B8D0A37DA977CC7A60420BD37889F14D7C349C0AE30AE6C76B863
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter 0xToxin
Tags:AGOSTOver2.80 pw-1234 rar RAT remcos RemcosRAT


Avatar
0xToxin
https://doc-14-8s-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/t299gnbq3r2uhqqnam7isk85505vs642/1666791750000/10571816973006863566/*/10_OSRMjs1oUOI1aGEwd_q8kfuWFfx7WE?e=download&uuid=c0cf1c84-d5ab-4435-b060-228d57fb19e7

Intelligence

File Origin
# of uploads :
1
# of downloads :
255
Origin country :
n/a
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:Demanda Civil-PDF.exe
File size:314'572'800 bytes
SHA256 hash: 653c10cff3816ee2e89241f7c3f35e1547aff936e98c4d5bf694429132179fc6
MD5 hash: 228e357f8d2a564782739cadad633cff
MIME type:application/x-dosexec
Signature RemcosRAT
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.63139304.2481.1409.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9b2f0fcf047e79588f1839e4ddc169abd6fadeae3ef20ce2132a7a64d6ffd297/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tmxq7tyepz4vrdyyhhsn3qljvplpvxvoh3zazyqtfj5gjvx72klq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9b2f0fcf047e79588f1839e4ddc169abd6fadeae3ef20ce2132a7a64d6ffd297

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments