MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d71d346b485960529fd9b619882ad951513ef5c110cda89f66cf8cd259fe0e37. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Matiex


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d71d346b485960529fd9b619882ad951513ef5c110cda89f66cf8cd259fe0e37
SHA3-384 hash: a7a40be3b7f661032f5694d6a66a4fe6a977b4031cc27106340acad0cdf783c231ba7b32622bd4f509d8492de7bde2ff
SHA1 hash: cbf60d24cb6b504aa5367b81453616adea3704ad
MD5 hash: b5ce5b5e37b4698b257a77a9c651aa65
humanhash: queen-seventeen-pluto-jersey
File name:0784645_2021_048890000748944994.pdf.7z
Download: download sample
Signature Matiex
Create hunting rule
File size:82'842 bytes
First seen:2021-03-10 17:12:15 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 1536:LJfY5frQNRBiigq601DtMiH5okpFb273y2Nxh1kAMHmpDKQrPp2nmJ:LJfMcNmmjnikP2bN7jDp+UR2mJ
TLSH 19830216FF186F80C5FA43B457969ECC67BC7B8D8827BF594C846087C02B27E92924B1
Reporter abuse_ch
Tags:7z OVPN RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: lucky1.263xmail.com
Sending IP: 211.157.147.132
From: 张贵强 <sale20@chinachuangxin.net>
Subject: Valid Prices
Attachment: 0784645_2021_048890000748944994.pdf.7z (contains "Purchase Order.exe")

RemcosRAT C2:
feromo.duckdns.org:8087 (185.157.161.113)

Intelligence

File Origin
# of uploads :
1
# of downloads :
299
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs231.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-03-10 17:12:25 UTC
AV detection:
7 of 46 (15.22%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=24oti22ilfqffh6zwymyqkwzkfit55obcdg2rh3gz6gnewp6by3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.10
Link:
https://yomi.yoroi.company/submissions/d71d346b485960529fd9b619882ad951513ef5c110cda89f66cf8cd259fe0e37

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Matiex

zip d71d346b485960529fd9b619882ad951513ef5c110cda89f66cf8cd259fe0e37

(this sample)

Matiex

Executable exe a6ef18e9d2328a5913921642c88d2ed623267700c19fa0b42b09b3904b2555c8

  
Dropping
MD5 29b2e21109872369edba9abaab7704b5
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a6ef18e9d2328a5913921642c88d2ed623267700c19fa0b42b09b3904b2555c8
  
Dropping
MD5 7a117807ce4b846a272a1c4dad423827
  
Dropping
SHA256 5932fcc4c5d01a0d7667dfe1e6d10dd8c540b2ac57623c8c4b99dfdcd43cd63e

Comments