MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f0ad1cb71c86946cfed8e05fe7bfee0c29ae5d7620eaed88d2adcd65b1e71b1a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f0ad1cb71c86946cfed8e05fe7bfee0c29ae5d7620eaed88d2adcd65b1e71b1a
SHA3-384 hash: 1f5475cf25efaa0d5c16c542899cdbcb2f0f8290814424e86eca78d1886d986e99ef1846f809207912ec37e62de2a478
SHA1 hash: 85f467fdc5c1ee3c96dd3bb51ce4f5f6a0ac502f
MD5 hash: 4580f352f68ab46ba77e053100456e7d
humanhash: mountain-cat-alaska-magnesium
File name:New order.pdf.zip
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:371'128 bytes
First seen:2021-02-18 15:13:12 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:DoL7DSvvSd2EhmaXKyCs8yMovjzo0eNZnnwuoFrPFI2nMQorQyK2BolbC5YgXODQ:Do7GEcaayTnMovjzojHoBPFI5QYQRC5d
TLSH 248423D28F814F3FCADD5B8DD0ABBE107D71799213408866D67CC834E8956899B7F8A0
Reporter abuse_ch
Tags:RAT RemcosRAT zip


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: cloudhost-2290780.us-midwest-1.nxcli.net
Sending IP: 8.36.41.54
From: Frank <rodrigo.espinosa@ridgid.com.mx>
Subject: New order
Attachment: New order.pdf.zip (contains "New order.pdf.exe")

RemcosRAT C2:
god111favour.ddns.net

Intelligence

File Origin
# of uploads :
1
# of downloads :
296
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_pdf.UNOFFICIAL
Create hunting rule

Win.Dropper.Fareit-9832696-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f0ad1cb71c86946cfed8e05fe7bfee0c29ae5d7620eaed88d2adcd65b1e71b1a/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-18 15:14:05 UTC
AV detection:
14 of 45 (31.11%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6cwrzny4q2kgz7wy4bp6pp7obqu24xlwedvo3cgsvxgwlmphdmna._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f0ad1cb71c86946cfed8e05fe7bfee0c29ae5d7620eaed88d2adcd65b1e71b1a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip f0ad1cb71c86946cfed8e05fe7bfee0c29ae5d7620eaed88d2adcd65b1e71b1a

(this sample)

RemcosRAT

Executable exe 512f42f440c86ec0b776da00cb7be1aac494914af73a8d47ada5b6a4b5f208eb

  
Dropping
MD5 46e4c4c88a4d3bfb06c40d56d3b30d94
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 512f42f440c86ec0b776da00cb7be1aac494914af73a8d47ada5b6a4b5f208eb

Comments