MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8a4956db8253c2f13ef71e65911f6aaf9cebee9883b87c3dfd21bfa45d166f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b8a4956db8253c2f13ef71e65911f6aaf9cebee9883b87c3dfd21bfa45d166f9
SHA3-384 hash: a11226dcab632ec97af0d53a0a30354e3f27938a286f4caa54d8c2221e8e47323e2aa819af615868a481b45929da39a4
SHA1 hash: 654d61e0548cbebad9c02742147f1387a6f52a23
MD5 hash: bf516ba1c29314e4465653629cd046d0
humanhash: jig-magazine-nebraska-uniform
File name:fatura 893454.pdf.zip
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:95'617 bytes
First seen:2021-04-02 08:45:23 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 1536:wEU5Uc0cpa3kWnIYF/m30ngul5ad0fi6ua85zOabIeMVw/XrPvX4PaPdc7B:wrK43WbF/m30guCd0fafIeMVwDPPPlct
TLSH 819312C8D53934CDC5F47592A22C0CAF10ACA1B234751A1792A346F3DA4A77C5BBE3A7
Reporter GovCERT_CH
Tags:RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
319
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_pdf.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/b8a4956db8253c2f13ef71e65911f6aaf9cebee9883b87c3dfd21bfa45d166f9
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b8a4956db8253c2f13ef71e65911f6aaf9cebee9883b87c3dfd21bfa45d166f9/
Threat name:
Win32.Trojan.SpyNoon
Create hunting rule
Status:
Malicious
First seen:
2021-04-01 10:37:05 UTC
AV detection:
8 of 26 (30.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xcsjk3nyeu6c6e7pohtfsepwvl445pxjra5ypq672in7urorm34q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Remcos
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b8a4956db8253c2f13ef71e65911f6aaf9cebee9883b87c3dfd21bfa45d166f9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip b8a4956db8253c2f13ef71e65911f6aaf9cebee9883b87c3dfd21bfa45d166f9

(this sample)

RemcosRAT

Executable exe 1b059ab1c0eca910c2882e26ac6f2e8ab795f0749294dfff4af528cb788d2d47

  
Dropped by
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1b059ab1c0eca910c2882e26ac6f2e8ab795f0749294dfff4af528cb788d2d47
  
Dropping
MD5 6c06c0b2f7ea9cbe47eaf1b5631729aa

Comments