MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9e403c678657ea736200d921d3ac410da97a15c73f9b1c7a3315a7186b07bfbc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9e403c678657ea736200d921d3ac410da97a15c73f9b1c7a3315a7186b07bfbc
SHA3-384 hash: 3de3653016874450e3de8a2d34df9018bedac4527ecabd802f0ae071cb13708fbf662d7f6e54dfa9de3439387cd4e4a1
SHA1 hash: fccf278607bd71d63da9b44f3d37f4259927fee9
MD5 hash: e8e1a15a1dbabf60347f2a21af323f5b
humanhash: sodium-oven-seventeen-winner
File name:Scan-Documents0012HDU5063GD7G.rar
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:194'708 bytes
First seen:2021-01-06 07:54:39 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:EsNWpwR/Z2JRE4ys/E+B03b5shnKbhCXhTzNmgcKvRlSZPSa7aQtmEadgtjb:EJmLSe4yx+ib5sngCXfmKShb7vtsYb
TLSH 571412C281BE7DABCC4F34FB06EAD536075F478ADA6161D94836BEDF82193824C61784
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: yahoo.co.in
Sending IP: 84.38.133.161
From: Amjad Karikal<swayam_e@yahoo.co.in>
Subject: Re: PO for LED Light and Cables
Attachment: Scan-Documents0012HDU5063GD7G.rar (contains "Scan-Documents0012HDU5063GD7G.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
176
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9e403c678657ea736200d921d3ac410da97a15c73f9b1c7a3315a7186b07bfbc/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-01-06 07:55:08 UTC
AV detection:
14 of 46 (30.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tzadyz4gk7vhgyqa3eq5hlcbbwuxufohh6nry6rtcwtrq2yhx66a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9e403c678657ea736200d921d3ac410da97a15c73f9b1c7a3315a7186b07bfbc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar 9e403c678657ea736200d921d3ac410da97a15c73f9b1c7a3315a7186b07bfbc

(this sample)

RemcosRAT

Executable exe 7938ab5a2e1c4eaf450a144c2d451cfab20feddb85eec8310f14fefebe09e953

  
Dropping
MD5 b21c78ec378b343b0ff5d642293f3d95
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7938ab5a2e1c4eaf450a144c2d451cfab20feddb85eec8310f14fefebe09e953

Comments