MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fbe31f961d7fc1bf7d32752faeef0230f7b8b49327d48fdb17edf2e983059e35. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fbe31f961d7fc1bf7d32752faeef0230f7b8b49327d48fdb17edf2e983059e35
SHA3-384 hash: 89be2cca5c3eb3861d127b3b1e563b251238567afbb1277b18b94384f72e44e3543d340e262890eea82c542d85aaf552
SHA1 hash: a82c569b966b37fb96bbdce6fc856bae5e36e73a
MD5 hash: face6bd9d9643eec14159c73fa5bf6f8
humanhash: mississippi-iowa-south-social
File name:ScanDocuments0002-pdf.zip
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:341'435 bytes
First seen:2020-08-19 09:28:30 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:PAfji+krSeEE2NY9ZECL0OuPDOVBIau9Qhy1Op0TG3mH79IEWAycmoG:PA7iuEf7dLUP8BIj1O+q3mbGTcmoG
TLSH 9974232F76A1A401443FF50A6F793AB832CF51E80139805D6E31A4D644EF6F7282CB6D
Reporter abuse_ch
Tags:RemcosRAT zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: professionaleventrun.com
Sending IP: 45.137.22.57
From: Qiqi Wang <garyk@professionaleventrun.com>
Subject: ORDER
Attachment: ScanDocuments0002-pdf.zip (contains "ScanDocuments0002-pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.25906.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fbe31f961d7fc1bf7d32752faeef0230f7b8b49327d48fdb17edf2e983059e35/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 21:54:00 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7prr7fq5p7a367jsoux253ycgd33rnete7ki7wyx5xzotayfty2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip fbe31f961d7fc1bf7d32752faeef0230f7b8b49327d48fdb17edf2e983059e35

(this sample)

RemcosRAT

Executable exe 5ef2d70f9e7fa30c9fea637c8b0c60276ca69505640ffb417a27a320575f3807

  
Dropping
MD5 dec6ea74b97f6b2f69d851955493bff7
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5ef2d70f9e7fa30c9fea637c8b0c60276ca69505640ffb417a27a320575f3807

Comments