MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c70f04478a19fa02ab1167631d0460100420cf070d4b0de5d52795b5c8ef5ed7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c70f04478a19fa02ab1167631d0460100420cf070d4b0de5d52795b5c8ef5ed7
SHA3-384 hash: 1d74f80fa1f7bd784d33c9a7c1f9c4a2c824cb37c930b4528be739b9f95cd21046f72bff9b157304cd59082fcda0a327
SHA1 hash: 7902e5c35f0631e17eb813233ce3175937a07903
MD5 hash: 2cfeafb4922fdebe8d2b5ff4bf169037
humanhash: timing-sweet-fanta-london
File name:Upit_Invoice.rar
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:530'948 bytes
First seen:2020-11-30 08:20:23 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:HrjkUGte3uYAYDH4+ROEmw3XuZtcumjnQVigFr:HXkUOYDYdOXuZtcB2N
TLSH 42B423E4A2DE410527D7345C30F28133C46A25F41E7A8B8DAAF53A3A7898337354FE69
Reporter fabjer
Tags:archive

Intelligence

File Origin
# of uploads :
1
# of downloads :
171
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27502.Rar5Heur.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c70f04478a19fa02ab1167631d0460100420cf070d4b0de5d52795b5c8ef5ed7/
Threat name:
Win32.PUA.Wacapew
Create hunting rule
Status:
Malicious
First seen:
2020-11-30 08:21:06 UTC
AV detection:
4 of 48 (8.33%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=y4hqir4kdh5afkyrm5rr2bdacaccbtyhbvfq3zove6k3lshpl3lq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c70f04478a19fa02ab1167631d0460100420cf070d4b0de5d52795b5c8ef5ed7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar c70f04478a19fa02ab1167631d0460100420cf070d4b0de5d52795b5c8ef5ed7

(this sample)

RemcosRAT

Executable exe 04f271742dac058c042af388562d7678536a47273846d692649926bad5dce1a0

  
Dropping
SHA256 04f271742dac058c042af388562d7678536a47273846d692649926bad5dce1a0
  
Delivery method
Distributed via e-mail attachment

Comments