MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bbf61a576918e5ca3f397ab58d5f7fe13dcc35b4af0a169d0b01d3bd3205396a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bbf61a576918e5ca3f397ab58d5f7fe13dcc35b4af0a169d0b01d3bd3205396a
SHA3-384 hash: d09ebf0b766bfb6789474c65c2c80b6334a17f0bcd8f4319eeb92b47dc86b05a9ec8bcab01b55fb512da5f0fd81aa237
SHA1 hash: 6b31ae1039309536df87f834762c83f9081e6a28
MD5 hash: e005780eaa0b0a7382298c69b9901892
humanhash: hot-maryland-hot-ack
File name:Mensaje Swift USD 58,866.00.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:612'352 bytes
First seen:2020-10-27 16:42:44 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:La9QRtJVkrg6s9BYoz1Abw0K/OKIcOY9C:Sy3krxssohAJK2KL
TLSH 18D48C22B7585BD8E17DA7782120410157FAFC6AE735D60D3CA970DD2E72B82C7A3B12
Reporter abuse_ch
Tags:iso RemcosRAT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.costadelsolperu.com
Sending IP: 200.48.237.51
From: alertasyavisos@bcp.com<naltmann@costadelsolperu.com>
Subject: TRANSFERENCIA
Attachment: Mensaje Swift USD 58,866.00.iso (contains "Mensaje Swift USD 58,866.00.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.4822.11010.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bbf61a576918e5ca3f397ab58d5f7fe13dcc35b4af0a169d0b01d3bd3205396a/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-10-27 14:28:24 UTC
AV detection:
4 of 48 (8.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xp3buv3jdds4upzzpk2y2x374e64ynnuv4fbnhilahj32mqfhfva._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bbf61a576918e5ca3f397ab58d5f7fe13dcc35b4af0a169d0b01d3bd3205396a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso bbf61a576918e5ca3f397ab58d5f7fe13dcc35b4af0a169d0b01d3bd3205396a

(this sample)

RemcosRAT

Executable exe 4579780c18fb273fd0884237c7a4021dbbb38494194d8c1840449e8a62d29251

  
Dropping
MD5 f1b7a8ecb46fd6d7b0bfd6fe4b23742e
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4579780c18fb273fd0884237c7a4021dbbb38494194d8c1840449e8a62d29251

Comments