MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 de63cdcb87487876c1eea7b77b9dad4723b0aa02edf0b6316c644d6762ec6c7a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: de63cdcb87487876c1eea7b77b9dad4723b0aa02edf0b6316c644d6762ec6c7a
SHA3-384 hash: 7bed611ed7dcbfaad4801cda780c1b8dc7fe110d38e3c2f8fe5b3e17f496e329c6bb425a8068b8c17d13186645ac6f9c
SHA1 hash: 517e40790be5d0f550e828c1a3216f61b6c4bd7f
MD5 hash: 6582fef673551f9ebcf3db2ed682bb50
humanhash: lion-diet-october-robert
File name:CMC1505026AA_Factura_C123580_20210304.pdf.zip
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:306'016 bytes
First seen:2021-03-05 13:06:54 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:SGk54rcVESqyokrGGnjWcWdtQjv/pEmiBZXO2Nlhj7KCH1qdIiqLPB+N:S55ESqyXrGGnjXWdQZcXOizj1Vqd5qLY
TLSH 695423880C147393A6E2828DAEC190D5FF818DA5CE59B8C9B1D6C76C03F5D6BA7D8631
Reporter abuse_ch
Tags:RAT RemcosRAT zip


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: slot0.cliveit.com
Sending IP: 194.31.96.114
From: Ms. Transmanche <postmaster@cliveit.com>
Reply-To: Ms. Transmanche <marketing.jnautomation.in@gmail.com>
Subject: March Shipment
Attachment: CMC1505026AA_Factura_C123580_20210304.pdf.zip (contains "CMC1505026AA_Factura_C123580_20210304.pdf.exe")

RemcosRAT C2:
greenfieldsde.duckdns.org

Intelligence

File Origin
# of uploads :
1
# of downloads :
321
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_pdf.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/de63cdcb87487876c1eea7b77b9dad4723b0aa02edf0b6316c644d6762ec6c7a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-05 13:07:09 UTC
AV detection:
14 of 47 (29.79%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3zr43s4hjb4hnqpou63xxhnni4r3bkqc5xylmmlmmrgwoyxmnr5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/de63cdcb87487876c1eea7b77b9dad4723b0aa02edf0b6316c644d6762ec6c7a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip de63cdcb87487876c1eea7b77b9dad4723b0aa02edf0b6316c644d6762ec6c7a

(this sample)

RemcosRAT

Executable exe 9b0bc9cfbb7f7206d7c6578b2c6b618654c455e4e9d0c2926441c89627cb7b8a

  
Dropping
MD5 adb28c624b0e2f4cd6a7e16ab37a7c30
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9b0bc9cfbb7f7206d7c6578b2c6b618654c455e4e9d0c2926441c89627cb7b8a

Comments