MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b1adde943a7ce755fe0528c602bf00a7f1fa87608a00051c726c296b0161e497. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b1adde943a7ce755fe0528c602bf00a7f1fa87608a00051c726c296b0161e497
SHA3-384 hash: 12a2388ecf9dcc72e962965f5fbe0ab5fa08516253bddace43da81090a5ce3b844a03bb3bf58af8f63c9840496e3a196
SHA1 hash: 0b7f2fbb8ae4498d570afd3a7d5ee4bb8589bbab
MD5 hash: 4b68030f27db1e2a8a326adfb542e73e
humanhash: ohio-avocado-magazine-freddie
File name:Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491.tgz
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:580'546 bytes
First seen:2020-11-19 08:22:30 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:fx8IGBhD6JWBxCt5b/qRZ1jCEHg5pzAGbmMMUngtkqsge:qBdSGxC5bCRZ1jqfzAGCfkHr
TLSH AAC42374DF47CD9047FD63D9ECA0DA89E9D08F65A9C7854B5CC06BBE064B682831E243
Reporter abuse_ch
Tags:Outlook RAT RemcosRAT tgz


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: NAM10-BN7-obe.outbound.protection.outlook.com
Sending IP: 40.92.40.106
From: TRACTOCAMIONES NEIVA <ventas_tracto@hotmail.es>
Subject: COBRO JURIDICO SERFINANZA.
Attachment: Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491.tgz (contains "Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe")

RemcosRAT C2:
databasepropersonombrecomercialideasearchwords.services:7580 (186.169.53.6)

Intelligence

File Origin
# of uploads :
1
# of downloads :
144
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.19993.25289.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b1adde943a7ce755fe0528c602bf00a7f1fa87608a00051c726c296b0161e497/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wgw55fb2pttvl7qffddafpyau7y7vb3ariaakhdsnquwwalb4slq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar b1adde943a7ce755fe0528c602bf00a7f1fa87608a00051c726c296b0161e497

(this sample)

RemcosRAT

Executable exe 6f493867adbd74622c28e2c1e670b4c1f64566ea830dbf7bd0c5905b858a33c8

  
Dropping
MD5 da9cf305f26cf0748736fd063f56e801
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6f493867adbd74622c28e2c1e670b4c1f64566ea830dbf7bd0c5905b858a33c8

Comments