MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d9b5613c82767ef51f5a918ec5e0c7ec646576038f0d0c28529ca1b0812321cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d9b5613c82767ef51f5a918ec5e0c7ec646576038f0d0c28529ca1b0812321cb
SHA3-384 hash: 8a3dab7583608aaa3b5598dc6505466b7984197070ef8266c1bb82f8c0ce0b27529f946fd01e86e4e997818d5ce7cefc
SHA1 hash: 62d5231d3cb592a1ad9f442f94acc56de34fd71a
MD5 hash: 80c4c66aa03074c17d367dc1875448e2
humanhash: foxtrot-glucose-spring-nebraska
File name:neue Bestellung pdf.zip
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:241'310 bytes
First seen:2021-03-29 06:38:14 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:rDEWmMt7OJ8ZoUBgdWUhemnOiB1ZhoLX6OAy1gB:rwqiuoU65lzheqB
TLSH 753423E078C20C1AA81ABA6CC148D20F9157F57AE45A258BE81D99367F6D775C033CFB
Reporter cocaman
Tags:zip


Avatar
cocaman
Malicious email (T1566.001)
From: "sebastian.wache@jobdistrict.de" (likely spoofed)
Received: "from linhost02.utic.net.ba (linhost02.utic.net.ba [195.130.35.141]) "
Date: "Mon, 29 Mar 2021 19:26:37 +1300"
Subject: "R: KO ACEA - [AC_OX8] - [Acea Prospect MBC] - [171-38] - [VR]"
Attachment: "neue Bestellung pdf.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_pdf.UNOFFICIAL
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/d9b5613c82767ef51f5a918ec5e0c7ec646576038f0d0c28529ca1b0812321cb
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d9b5613c82767ef51f5a918ec5e0c7ec646576038f0d0c28529ca1b0812321cb/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-03-29 06:39:05 UTC
File Type:
Binary (Archive)
Extracted files:
69
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3g2wcpecoz7pkh22sghmlygh5rsgk5qdr4gqykcstsq3bajdehfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d9b5613c82767ef51f5a918ec5e0c7ec646576038f0d0c28529ca1b0812321cb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip d9b5613c82767ef51f5a918ec5e0c7ec646576038f0d0c28529ca1b0812321cb

(this sample)

RemcosRAT

Executable exe c771c0417fcf76bac5cb23d5213338c6c8f8b381f6744a7619feb36edec1dacb

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c771c0417fcf76bac5cb23d5213338c6c8f8b381f6744a7619feb36edec1dacb

Comments