MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9c764371c5dae46831d70d615406cb9ce2de643b8a22fa16404ad1d0f65adc7d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9c764371c5dae46831d70d615406cb9ce2de643b8a22fa16404ad1d0f65adc7d
SHA3-384 hash: 0bcb8b3b83290cd7220d91813a74f38432adbda290f5c0ebb3626ee1c90ca74fa8a720cc527ede62312edadb2de42097
SHA1 hash: c6c023b4d2d45ae74a00c02a5bec9c87b3d0298e
MD5 hash: 89c04e3b277c97757ec5dc91d6986244
humanhash: football-mobile-coffee-apart
File name:_(COVID-19) conseils au grand public.xlsm
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:809'472 bytes
First seen:2020-03-18 13:13:34 UTC
Last seen:Never
File type:Excel file xlsm
MIME type:application/encrypted
ssdeep 12288:TDMQrWQQj025ioyERgY7WxvwTUjBhtiPKUnlvUW9whgQYDoGcm8HVLx0oBk/5:044o20zERxCxvDVLOndmhgn3WLFB65
TLSH E9052300FDF6468BEBB3993A5532CEBC99A4DC09C352C043316D76912E35ABB9CCB255
Reporter MalwareWisperer
Tags:CVE-2017-11882 Downloader


Avatar
MalwareWisperer
encrypted excel doc delivering a Remcos variant

Intelligence

File Origin
# of uploads :
1
# of downloads :
144
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Doc.Packed.EncryptedDoc-6563700-0
Create hunting rule

Gathering data
Threat name:
Document-Word.Exploit.CVE-2017-11882
Create hunting rule
Status:
Malicious
First seen:
2020-03-19 03:56:14 UTC
AV detection:
15 of 31 (48.39%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9c764371c5dae46831d70d615406cb9ce2de643b8a22fa16404ad1d0f65adc7d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Excel file xlsm 9c764371c5dae46831d70d615406cb9ce2de643b8a22fa16404ad1d0f65adc7d

(this sample)

RemcosRAT

Executable exe af1cf572150e95fd75306a13eb3d2306e1e1fb4ef6c238f53f30f2525389e07b

anyrun
any.run
https://app.any.run/tasks/391d948b-bddc-416d-8f9d-6a2ed04286e8/
  
Dropping
MD5 438C2A41E17072288E838FF09760ED5F
  
Delivery method
Distributed via e-mail attachment

Comments