MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c0274d3c1013ed27161dfac219fe6d044c94aa4f1267d8126866bb66f5a5e8b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c0274d3c1013ed27161dfac219fe6d044c94aa4f1267d8126866bb66f5a5e8b4
SHA3-384 hash: c9b337363d6217cdf91d0747d6fa28364809185d5d6e52b869263675cd7e9ba927c30d5d1cebd5232dce3886b60e892c
SHA1 hash: e9664631af3c6ed48d0e2bce1741f75be1368735
MD5 hash: a55c6e6ccccc2918a81dd4cd2cef6851
humanhash: hotel-rugby-mango-three
File name:Request HMI 8130-3.pdf.7z
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:838'289 bytes
First seen:2021-01-11 08:18:22 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 24576:R4AzSm64ITMt4aJygruB35QKITwpw/Vg9Tbyx5f:R4AziJMCaJyghKIT64VgJyvf
TLSH E905231ACDF8F6AD924C3DEE2830DD5204FB808E952EFAD54D1FF74286648026355B9E
Reporter abuse_ch
Tags:7z


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: WIN-BKIQ3LS7OGB
Sending IP: 185.222.57.214
From: Ashwin Sakpal <a.peramountinternational@gmail.com>
Subject: URGENT RQF HMI 8130-3 victim-domain
Attachment: Request HMI 8130-3.pdf.7z (contains "Request ## HMI 8130-3##.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
118
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c0274d3c1013ed27161dfac219fe6d044c94aa4f1267d8126866bb66f5a5e8b4/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-11 08:19:06 UTC
AV detection:
12 of 45 (26.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yatu2paqcpwsofq57lbbt7tnargjjkspcjt5qetim25wn5nf5c2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c0274d3c1013ed27161dfac219fe6d044c94aa4f1267d8126866bb66f5a5e8b4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

7z c0274d3c1013ed27161dfac219fe6d044c94aa4f1267d8126866bb66f5a5e8b4

(this sample)

RemcosRAT

Executable exe 059ac87b5d6736721984e912bc0dcca50506fba170787b6aedb85e94b9683642

  
Dropping
MD5 d91456035c9e48c7b8da1ebcd4d6cdbc
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 059ac87b5d6736721984e912bc0dcca50506fba170787b6aedb85e94b9683642

Comments