MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dabb5e9259e21b141967595b3494681c0ceaa205eeb13378ff920c92739969b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dabb5e9259e21b141967595b3494681c0ceaa205eeb13378ff920c92739969b3
SHA3-384 hash: b48d5b34cd8d695a0d60d39b629aebd624d6dd545c67083841da1d3e6af2c3d6e855ec027035047823aaa5fa718b7fe9
SHA1 hash: 6bcd7bc57bdac70d17cc76fd906131030c95832c
MD5 hash: 456f7f2047dccf11e457088de42f5939
humanhash: bluebird-oscar-golf-seventeen
File name:20NS10-A-R 20-9-7.r00
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:185'709 bytes
First seen:2020-10-21 13:06:57 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 3072:21ceCmXywXUnDWNRUSk6m2G3KicpjH0m5riPxLo6iEo5bQRZtSGMTGp20v:QVCmlyDWwSDmL3kpjH0mxiRpWb8lkGJ
TLSH 4504236257D65215AB3D9D9B6034309B12F0600AF3B3E7BC8E72CEC5798381E5E63263
Reporter abuse_ch
Tags:r00 RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: jax4mhob25.registeredsite.com
Sending IP: 64.69.218.113
From: George Tzivelopoulos <e-Texelco1@texelco.gr>
Subject: PO 14704 - MEL - 20' TC Reefer / Sailing Schedule
Attachment: 20NS10-A-R 20-9-7.r00 (contains "20NS10-A-R 20-9-7,pdf.exe")

RemcosRAT C2:
incidencias6645.ddns.net

Intelligence

File Origin
# of uploads :
1
# of downloads :
49
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dabb5e9259e21b141967595b3494681c0ceaa205eeb13378ff920c92739969b3/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-21 12:26:48 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3k5v5esz4inriglhlfntjfdidqgoviqf52ytg6h7sigje44zngzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/dabb5e9259e21b141967595b3494681c0ceaa205eeb13378ff920c92739969b3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

r00 dabb5e9259e21b141967595b3494681c0ceaa205eeb13378ff920c92739969b3

(this sample)

RemcosRAT

Executable exe 3c1ce706aa7b96510a66e677037aa60b52ad2bbe1b02c2dc708e338842fe7e4a

  
Dropping
MD5 6aa1dc2cf3bd3bf171dad674cdbb1fda
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3c1ce706aa7b96510a66e677037aa60b52ad2bbe1b02c2dc708e338842fe7e4a

Comments