MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5cfecc34cdbc8f94d6b0e3dbee8465e15db59f26a8bebccd278d7378709099e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5cfecc34cdbc8f94d6b0e3dbee8465e15db59f26a8bebccd278d7378709099e9
SHA3-384 hash: 9e834e87d8a60c95b57720aaecfee10cfa5f534edfc4ba5e6ebb09d866c0593303ffd644a3ae3c5455e13258a10cef87
SHA1 hash: e30849f0cb16cf5170f3b040228b535af2409ccb
MD5 hash: 33b77520a8644314f6881fd5749171b8
humanhash: december-pizza-early-delaware
File name:myattachfile.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'900'544 bytes
First seen:2020-06-17 15:53:03 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:o88RMlLc25p1sNakyTPouyefk4DJwPPhvPwo:okFc2guyQbDJwXBP
TLSH 0E955C21A2D19837C0231574DD26A368E829FF102939984E3FE97D485F3678DF82679F
Reporter cocaman
Tags:iso RemcosRAT


Avatar
cocaman
Malicious email
From: "UPS Customer Service" <customer@ups.com>
Received: from dddd0.eastus.cloudapp.azure.com (unknown [52.149.224.84])
Date: Wed, 17 Jun 2020 14:47:12 +0000
Subject: UPS - Pending delivery
Attachment: myattachfile.iso

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

Gathering data
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-06-17 19:17:00 UTC
File Type:
Binary (Archive)
Extracted files:
54
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lt7myngnxshzjvvq4pn65bdf4fo3lhzgvc7lztjhrvzxq4eqthuq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso 5cfecc34cdbc8f94d6b0e3dbee8465e15db59f26a8bebccd278d7378709099e9

(this sample)

RemcosRAT

Executable exe c59842c19c1b3f0171b40eebfb3e98ddccc4237edcaaa62990a0881ee1f6f798

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c59842c19c1b3f0171b40eebfb3e98ddccc4237edcaaa62990a0881ee1f6f798
  
Dropping
RemcosRAT

Comments