MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f1dfc16b40085823d7a82508d49e0e1f370128cb15d23420c6a23b3f311087df. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f1dfc16b40085823d7a82508d49e0e1f370128cb15d23420c6a23b3f311087df
SHA3-384 hash: 970b2eeab0c13654d7eda48636fd429364c8ccd57adf6c3b9ec9250d27e0ab526c7f754c1e0511e2bcf6c6aef36d1bb6
SHA1 hash: fee7b1dee99d59020748b09b38a1c46903f02609
MD5 hash: 60278c30364ef56c2ddc5d019a85a1a9
humanhash: quiet-arkansas-apart-bluebird
File name:Payment_NotificationFnb_Ref.rar
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'272'763 bytes
First seen:2020-08-27 05:34:53 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:FCyUh392XSZ+u/2rcwehGlgToVO0rYZLLzetixV11d5rnRkaqenGLhcuu:FCFlH2JehG7hryLzxnxRNnGlch
TLSH 4E453351E4AC105BE5E129E631BF32C4E48471483C1E5E4FBA34CF76AA5DE0AA7E46CC
Reporter abuse_ch
Tags:rar RemcosRAT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: rdns2.certserverss.xyz
Sending IP: 193.70.111.227
From: inContact@fnb.co.za
Subject: FNB:-) N$4507.50 paid to @ Online Banking Wallet. Ref.Aven Inv543.
Attachment: Payment_NotificationFnb_Ref.rar (contains "Payment_Notification(Fnb)_Ref_1090_00003_9999200211_2.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f1dfc16b40085823d7a82508d49e0e1f370128cb15d23420c6a23b3f311087df/
Threat name:
Win32.Trojan.Delf
Create hunting rule
Status:
Malicious
First seen:
2020-08-27 05:36:07 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6hp4c22abbmchv5ieuenjhqod43qckglcxjdiiggui5t6miqq7pq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f1dfc16b40085823d7a82508d49e0e1f370128cb15d23420c6a23b3f311087df

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar f1dfc16b40085823d7a82508d49e0e1f370128cb15d23420c6a23b3f311087df

(this sample)

RemcosRAT

Executable exe 7133d7e48e25500913021a3d2c6d4efa3d9ace18d9887cd899f64c3c598c037a

  
Dropping
MD5 3dffc262a947fffe09a82e695c9ce519
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7133d7e48e25500913021a3d2c6d4efa3d9ace18d9887cd899f64c3c598c037a

Comments