MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cdeefb28c2cbba61b7bf07b78b38dd30b54bcab09f525580a4bba8abefa0bb36. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cdeefb28c2cbba61b7bf07b78b38dd30b54bcab09f525580a4bba8abefa0bb36
SHA3-384 hash: a83247e0a6ee8b9dc0a8a189debe7fbe9e052f95e68e11c2f185f628f6e18b10c2dee340fcb4cf6db6abc2910b389a81
SHA1 hash: 91b618573731975483f14581e89b69bc2390321c
MD5 hash: c648bed4070e8a0c4e4ef8e15f02c268
humanhash: carpet-undress-nineteen-thirteen
File name:Cotización de factura.pdf.z
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:141'321 bytes
First seen:2021-01-12 18:13:43 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:vCYVtnalHQ/T9a0G6GAiy/KmZnI93DRJECcsBgQDHoE4QbVvHCiB:vbVtnRk0aAPTnIpDRJEtsBJLDvB
TLSH 73D31373D7BCE924C2E4357CF4B9F020A6D9C8D1292DAEAA44635AC740606B1FC9DC2D
Reporter abuse_ch
Tags:RAT RemcosRAT z


Avatar
abuse_ch
Malspam distributing RemcosRAT:

From: r.abouldahab@emis-int.com
Subject: Cotización de factura
Attachment: Cotización de factura.pdf.z (contains "Cotización de factura.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.Generic-S.12943.29940.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cdeefb28c2cbba61b7bf07b78b38dd30b54bcab09f525580a4bba8abefa0bb36/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-12 18:14:13 UTC
AV detection:
11 of 46 (23.91%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zxxpwkgczo5gdn57a63ywog5gc2uxsvqt5jflafexoukx35axm3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.92
Link:
https://yomi.yoroi.company/submissions/cdeefb28c2cbba61b7bf07b78b38dd30b54bcab09f525580a4bba8abefa0bb36

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip cdeefb28c2cbba61b7bf07b78b38dd30b54bcab09f525580a4bba8abefa0bb36

(this sample)

RemcosRAT

Executable exe 5d18283ed1cb2d7e7bd78e87821b3aa2f2ea64b01e28736098a3922fea61fe71

  
Dropping
MD5 c615c0190a56b52735589ac7bc9a6f9a
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5d18283ed1cb2d7e7bd78e87821b3aa2f2ea64b01e28736098a3922fea61fe71

Comments