MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eebd107a39c23c8b61a8c2d2379e8f139461c93fd488060a775ea7678067bc74. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eebd107a39c23c8b61a8c2d2379e8f139461c93fd488060a775ea7678067bc74
SHA3-384 hash: e03603aea0917ed2ee589c7df1f4e35188607ba2698794ca219063070758b3f4fc60439c1fc401c6e397d863588f04d3
SHA1 hash: 9373d5e15816519b2568f14f352189315505a15a
MD5 hash: a6c6faef95c91e83ab297e9660748fb2
humanhash: lake-vermont-georgia-single
File name:file.zip
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:241'527 bytes
First seen:2020-08-06 06:55:21 UTC
Last seen:Never
File type: zip
MIME type:application/x-rar
ssdeep 6144:QsMBR+ld/MpqhyRH76FVAzNbazzPAEipuB:QBGlNMpzH76nAzKzPripuB
TLSH 4C3423D51042176B22D0C1FD23979B37313B160765BEA258FA95EAC7E025E85F2B83F8
Reporter abuse_ch
Tags:Outlook zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: NAM10-DM6-obe.outbound.protection.outlook.com
Sending IP: 40.92.41.31
From: Yeimy Alejandra Artunduaga <kenga2104@hotmail.com>
Subject: FACTURA EN MORA SERFINANZA.
Attachment: file.zip (contains "Factura Serfinanza_034578048428307_3170631_0418109729596478852_04603130_103428501791086170850_68326557_16011451263_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eebd107a39c23c8b61a8c2d2379e8f139461c93fd488060a775ea7678067bc74/
Threat name:
ByteCode-MSIL.Backdoor.Remcos
Create hunting rule
Status:
Suspicious
First seen:
2020-08-06 06:57:06 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=526ra6rzyi6iwyniyljdphupcokgdsj72seamctxl2twpadhxr2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/eebd107a39c23c8b61a8c2d2379e8f139461c93fd488060a775ea7678067bc74

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip eebd107a39c23c8b61a8c2d2379e8f139461c93fd488060a775ea7678067bc74

(this sample)

RemcosRAT

Executable exe d03674f0452d3be687784b62b84f2cb32e6d8dd59beaeccd1608b07cae1aef4f

  
Dropping
MD5 315bc7890c391279834739e77167f0bc
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d03674f0452d3be687784b62b84f2cb32e6d8dd59beaeccd1608b07cae1aef4f

Comments