MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b3a4e113d27d532eb1769213c4e0c2e688d2228229aa513a746af14bf2cf74f4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b3a4e113d27d532eb1769213c4e0c2e688d2228229aa513a746af14bf2cf74f4
SHA3-384 hash: 514618e345c1f21014e8d4a96968d21c845ef3fda5a589650afe559fa326477e02c3a215a333002c98672e0c1e679fd3
SHA1 hash: d516e3e5447aad8f657f3d5ee14efb95da705454
MD5 hash: 10a803dcbb32df19a831eebb5ff3b98f
humanhash: earth-fish-batman-bluebird
File name:Payment 18 10 2020.gz
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:404'343 bytes
First seen:2020-10-19 06:30:53 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:GbjcCNAyOLKLHDMsDbIPeXVTEK8v/Xz+j6:SjVAi3kO38XXH
TLSH 8184236E706CD3C19C2D939CDDC2533075185A1EDC02B8A76AFA138AF63BA91351F693
Reporter abuse_ch
Tags:gz RemcosRAT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: yandex.com
Sending IP: 37.49.225.133
From: stoneadamss@yandex.com
Subject: RETURNED PAYMENT
Attachment: Payment 18 10 2020.gz (contains "Payment 18 10 2020.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b3a4e113d27d532eb1769213c4e0c2e688d2228229aa513a746af14bf2cf74f4/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-18 23:37:39 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wosoce6spvjs5mlwsij4jygc42eneiucfgvfcotunlyux4wpot2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b3a4e113d27d532eb1769213c4e0c2e688d2228229aa513a746af14bf2cf74f4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

gz b3a4e113d27d532eb1769213c4e0c2e688d2228229aa513a746af14bf2cf74f4

(this sample)

RemcosRAT

Executable exe fd1f86d98d28f8e9ae73acf4609e8cc0e669e97495c7d9bf679151b47432e005

  
Dropping
MD5 4703bea7e09685c37eb0f53291feaa91
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fd1f86d98d28f8e9ae73acf4609e8cc0e669e97495c7d9bf679151b47432e005

Comments