MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b91adc2dddfecd60dc568791a46aa03ad6081216027acacc40b42a978e07a764. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b91adc2dddfecd60dc568791a46aa03ad6081216027acacc40b42a978e07a764
SHA3-384 hash: 709f22b8a374b15ffa6672b847e0e7ce0f2efb3b785586fdd774611a3a2d9e484fe04e4d1ae6d8416606745caed18669
SHA1 hash: e7058f3967ac90edc23b925509a5715fd5672361
MD5 hash: 8ac5cf708d95c7759426aebd70347e3e
humanhash: tennis-six-one-alaska
File name:Covid-19 relief.img
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:614'400 bytes
First seen:2020-11-18 12:32:20 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:VL+0RTQHdWvvurs1UGKuOYmk3auPnfyuSkwzAT0Yne6cjnuQwG2U9bZ8BjAPuE5x:Y0x4YvWgqe1fSDzY3e6caBGV9b3PuIT
TLSH 23D4DF02ABB6DE7BC7F436FB105170490E5D9E909CB1BA81BA5CB059FEB3F02D490196
Reporter abuse_ch
Tags:COVID-19 img RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: englam.com.sg
Sending IP: 103.11.189.57
From: IRS <noreply@taxpayers.com>
Subject: Coronavirus Tax Relief and Economic Impact Payments
Attachment: Covid-19 relief.img (contains "Covid-19 relief.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
111
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.461.27340.10996.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b91adc2dddfecd60dc568791a46aa03ad6081216027acacc40b42a978e07a764/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-11-18 12:33:04 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xennylo573gwbxcwq6i2i2vahllaqeqwaj5mvtcawqvjpdqhu5sa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

img b91adc2dddfecd60dc568791a46aa03ad6081216027acacc40b42a978e07a764

(this sample)

RemcosRAT

Executable exe e85de613abef99e65212dcd6f8077b03763fa37fa81e7921907c9e9c3859b632

  
Dropping
MD5 5dd2c165636eff7f866e18370351101e
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e85de613abef99e65212dcd6f8077b03763fa37fa81e7921907c9e9c3859b632

Comments