MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bc6f470abaebcea42f89d84462b8ad29690e4a21fb209e160efa2b29c6c1b3d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bc6f470abaebcea42f89d84462b8ad29690e4a21fb209e160efa2b29c6c1b3d5
SHA3-384 hash: faa310c63b91ae84bb0f6fc67bd77a449de459778cbce3de3babf0910bd252ac229663dad268823cc3bcf499e6146c66
SHA1 hash: 1b962940de4640ce9a96afd598644b9bf6e94900
MD5 hash: 9338ff305344cc11fba08e0ac4c8803e
humanhash: orange-indigo-hotel-nebraska
File name:Payment-Advice-Note from 12-10-2020.gz
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:445'121 bytes
First seen:2020-10-12 14:44:47 UTC
Last seen:2020-10-13 02:44:01 UTC
File type: gz
MIME type:application/x-rar
ssdeep 12288:WtZa/iIwHrzj6N+nQvED5WJpLWOIKgLEEnIy8kE:OZa6I7+nQvbWuSjxE
TLSH 33942383C06CE73E75548BDCC98005060B9B62FA12975CCF6F1079B0662B756ABF26A9
Reporter abuse_ch
Tags:gz RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: barry-callebaut.com
Sending IP: 37.49.225.237
From: ap_queries_switzerland@barry-callebaut.com
Subject: Payment Advice Note from 12.10.2020
Attachment: Payment-Advice-Note from 12-10-2020.gz (contains "Payment-Advice-Note from 12-10-2020.exe")

Intelligence

File Origin
# of uploads :
4
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20201014-0802.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bc6f470abaebcea42f89d84462b8ad29690e4a21fb209e160efa2b29c6c1b3d5/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-12 14:46:07 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xrxuocv25phkil4j3bcgfofnffuq4srb7mqj4fqo7ivstrwbwpkq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/bc6f470abaebcea42f89d84462b8ad29690e4a21fb209e160efa2b29c6c1b3d5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

gz bc6f470abaebcea42f89d84462b8ad29690e4a21fb209e160efa2b29c6c1b3d5

(this sample)

RemcosRAT

Executable exe 659b0da98e348344d29abb19796211921453463c9a8c61649ef193171ff4a2c0

  
Dropping
MD5 594666f8f7f480e13468d85767e685f4
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 659b0da98e348344d29abb19796211921453463c9a8c61649ef193171ff4a2c0

Comments