MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a58ec763da18de28882b7d85768bf57fac5df971327776e8ce0eb1eaf930e9a1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a58ec763da18de28882b7d85768bf57fac5df971327776e8ce0eb1eaf930e9a1
SHA3-384 hash: 09f1d79891b76becbf47c2455e1fb63ec8f683a66162a4ffa9cf7bd50d46eda3a42ce74d59a670523a128bcfe8cedf48
SHA1 hash: 195cc8c7854477a635ba0d1cb9a9f2d708ac96e2
MD5 hash: 96563af4a6e5d5b9246f3f5f06783f84
humanhash: robin-connecticut-ohio-bravo
File name:Baumer RFQ 532096__pdf.zip
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:266'113 bytes
First seen:2020-10-23 06:54:34 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:/zCv4VDW3q+hUkq51QgfKtVyXyubltOyr0:RMBVq5r/iubGL
TLSH 4E4423A09E371EE1997A13FD85D531BC2670623033AC9ABDB35AE73281C0669589DCC7
Reporter abuse_ch
Tags:RemcosRAT zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: e-server.org
Sending IP: 111.221.44.74
From: sales.ch@baumer.com
Subject: Baumer RFQ
Attachment: Baumer RFQ 532096__pdf.zip (contains "Baumer RFQ 532096__pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a58ec763da18de28882b7d85768bf57fac5df971327776e8ce0eb1eaf930e9a1/
Threat name:
ByteCode-MSIL.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-10-23 00:15:11 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uwhmoy62ddpcrcblpwcxnc7vp6wf36lrgj3xn2gob2y6v6jq5gqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip a58ec763da18de28882b7d85768bf57fac5df971327776e8ce0eb1eaf930e9a1

(this sample)

RemcosRAT

Executable exe f0f5332559c5b4423f52173fbbde05923b236a0d32c97ad858b25621d5bf117a

  
Dropping
MD5 33a4a5d7e53055d3a03d57d5e4264995
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f0f5332559c5b4423f52173fbbde05923b236a0d32c97ad858b25621d5bf117a

Comments