MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd27aca89a29054b26fd0e55757bfad27820e29866d94f1229a635f9b0c9fdb2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dd27aca89a29054b26fd0e55757bfad27820e29866d94f1229a635f9b0c9fdb2
SHA3-384 hash: 87d10fe2c20112a575a6920620c4ce9c295f470b76153c83ecb45c42ab50507f376484b1ba6085e3d770742077e6331b
SHA1 hash: 0e9b2a50e325bbc10066008dbfc04f9f442f2d61
MD5 hash: b028233f8f93434c12dd31f63de3e65c
humanhash: alaska-oranges-saturn-lake
File name:IMAGE_DOCUMENTS_SCAN02904948.Z
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:195'765 bytes
First seen:2020-10-09 06:34:16 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:yIhC2cZKvcNUEsqe15P7qNJYUbEqZtBhRXpk8oLprEaSLyJwsV5fXlWz6z9tRQVh:yIhC2cZKiUtxXToJ1AENk1rEacs/flXy
TLSH E0141378EC9284D5BB8FF40F44183BA7919DFA1807EC33826D4F69D5718BBAC8190C95
Reporter abuse_ch
Tags:RAT RemcosRAT z


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: temmermarble.com
Sending IP: 185.29.10.101
From: MURAT ERGÜN <m.ergun@temmermarble.com>
Subject: Quotation for MARBLE SLABS
Attachment: IMAGE_DOCUMENTS_SCAN02904948.Z (contains "IMAGE_DOCUMENTS_SCAN02904948.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dd27aca89a29054b26fd0e55757bfad27820e29866d94f1229a635f9b0c9fdb2/
Threat name:
ByteCode-MSIL.Trojan.Perseus
Create hunting rule
Status:
Malicious
First seen:
2020-10-08 11:52:17 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3ut2zke2fecuwjx5bzkxk6722j4cbyuym3mu6erjuy27tmgj7wza._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Remcos
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dd27aca89a29054b26fd0e55757bfad27820e29866d94f1229a635f9b0c9fdb2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip dd27aca89a29054b26fd0e55757bfad27820e29866d94f1229a635f9b0c9fdb2

(this sample)

RemcosRAT

Executable exe 7a86f1fa947ada93a5a8ecf5824ce2034152e50ba8b53fe6904fd10c62e88adf

  
Dropping
MD5 de211a8850e87b2ca5d92c4ff7611100
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7a86f1fa947ada93a5a8ecf5824ce2034152e50ba8b53fe6904fd10c62e88adf

Comments