MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c8ea3ac2420b65b01368ea060c12b62215821acc99d83af28491e7645d33ed2d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c8ea3ac2420b65b01368ea060c12b62215821acc99d83af28491e7645d33ed2d
SHA3-384 hash: 271c9b115dbd93906c4a8a7189f9748e5d488565e22171168d19bee0f62e15eafd169ddea67e4cef3995d69fae8116af
SHA1 hash: dc5dcce0bba58d55ddab576ff368d5bc9312eb68
MD5 hash: 700e703de940438a2e3110f7f4f171c0
humanhash: fish-butter-six-east
File name:PO 456123489.img
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:667'648 bytes
First seen:2020-11-02 10:37:13 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:WYozZG2CAzR8Y0L/MPCgYbJQYzVa0JXwcarTG6R3zhj3+JXnK:9qiA98Y0LMPjOz/qFFSXnK
TLSH C2E484F440EF10A2F25F853936ADBE9401B2B1C7DBDA5E08137DE5311BBEA623A0564D
Reporter cocaman
Tags:img RemcosRAT


Avatar
cocaman
Malicious email (T1566.001)
From: "Steve Park <pavin@zg.htnet.hr>"
Received: "from postfix-inbound-9.inbound.mailchannels.net (inbound-egress-3.mailchannels.net [34.214.167.131]) "
Date: "2 Nov 2020 01:07:50 -0800"
Subject: "Re: "
Attachment: "PO 456123489.img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c8ea3ac2420b65b01368ea060c12b62215821acc99d83af28491e7645d33ed2d/
Threat name:
Win32.Trojan.Bluteal
Create hunting rule
Status:
Malicious
First seen:
2020-11-02 08:35:56 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zdvdvqscbns3ae3i5idayevweikyegwmthmdv4ueshtwixjt5uwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c8ea3ac2420b65b01368ea060c12b62215821acc99d83af28491e7645d33ed2d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

img c8ea3ac2420b65b01368ea060c12b62215821acc99d83af28491e7645d33ed2d

(this sample)

RemcosRAT

Executable exe 11b16ba733f2f4f10ac58021eecaf5668551a73e2a1acfae99745c50bfccbb44

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 11b16ba733f2f4f10ac58021eecaf5668551a73e2a1acfae99745c50bfccbb44
  
Dropping
RemcosRAT

Comments