MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d889909dc9815fc9aab4b571acf5cd0b97933053070197b3f5bce583a80f1780. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Matiex


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d889909dc9815fc9aab4b571acf5cd0b97933053070197b3f5bce583a80f1780
SHA3-384 hash: 81a3ce4ad832348d597e8a3650ae3b03564e930664f097e4fcd4f59d6084d014a10566787de06ce6504a4af73b1bce90
SHA1 hash: 14452b8493b76ce21336e7cfa86a6c774a304945
MD5 hash: 94d7716329ca00b6c5b384406b8007eb
humanhash: mango-finch-finch-carbon
File name:0264578884_6845134_8565900_pdf.bv.7z
Download: download sample
Signature Matiex
Create hunting rule
File size:112'250 bytes
First seen:2021-03-10 07:21:48 UTC
Last seen:2021-03-10 07:22:17 UTC
File type: zip
MIME type:application/zip
ssdeep 1536:V3KTOERw7llIcg4c0cFzE/oMpdOez2XqTnYxe3u8/VM6F9zPXW9oLi6M6W3NNbwo:dUCPgOcFzOocdOM26tu+M65lu3t9Sm
TLSH F7B3121F5448C6BB82EF33673CEF863537E42F89054DDA9D7EA29184CBC18C45AA5922
Reporter abuse_ch
Tags:7z OVPN RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: lucky1.263xmail.com
Sending IP: 211.157.147.131
From: 张贵强 <sale20@chinachuangxin.net>
Subject: Valid Prices
Attachment: 0264578884_6845134_8565900_pdf.bv.7z (contains "Purchase Order.exe")

RemcosRAT C2:
feromo.duckdns.org:8078 (185.157.161.113)

Intelligence

File Origin
# of uploads :
2
# of downloads :
302
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs231.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-03-10 07:22:09 UTC
AV detection:
6 of 47 (12.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3cezbhojqfp4tkvuwvy2z5onbolzgmcta4azpm7vxtsyhkapc6aa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.10
Link:
https://yomi.yoroi.company/submissions/d889909dc9815fc9aab4b571acf5cd0b97933053070197b3f5bce583a80f1780

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Matiex

zip d889909dc9815fc9aab4b571acf5cd0b97933053070197b3f5bce583a80f1780

(this sample)

RemcosRAT

Executable exe bd2130b9722512ac8b0e510c2c6ca47186055272b3835754a0e2469989baecfd

  
Dropping
MD5 17753468b5976b8e8d3b8fac52d122e0
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bd2130b9722512ac8b0e510c2c6ca47186055272b3835754a0e2469989baecfd
  
Dropping
SHA256 254d7bf9cb577037dd84ee7581f321df81d6c3013dd4a98b4bb7d01262e4455d
  
Dropping
MD5 50ad8968ed2c9c82e2d4834d41c11f6e

Comments