MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 889052d8a645776eb87cc8f4544965174654aa46f4d39562aab7b825baf64a50. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 889052d8a645776eb87cc8f4544965174654aa46f4d39562aab7b825baf64a50
SHA3-384 hash: 74f936ccbd1f32bff77466aba0dda7a9aec11ae22883a619c4e552036feb6a2c532530048392f62a0b03564ab2465b4e
SHA1 hash: 47fe8e66d876836a7f9e16eec30c23bf7aa0b028
MD5 hash: 8dda20182f2bea84f114dfcd13bfafc8
humanhash: item-nebraska-cup-summer
File name:PO 4524229716 Holy Caruschka Zavala Figueroa ,pdf.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:892'928 bytes
First seen:2020-06-26 15:41:46 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:dHDP+feVTP9D8jFUnohgvBsMWwo1fkR3CcYs6z7x1J11Mwb:VLVR9gjF8ohgvBfo9kchz1x
TLSH 8A157D62F2915A3BD0321A7C8D1B52985927FD112D3C9D867FFC9E4C5F2A3817C292A3
Reporter abuse_ch
Tags:BGR geo iso RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: host.eclicsys.org
Sending IP: 45.79.145.22
From: Holy Caruschka Zavala Figueroa <Holy.Zavala@univarsolutions.com>
Subject: Re: PO# 4524229716
Attachment: PO 4524229716 Holy Caruschka Zavala Figueroa ,pdf.iso (contains "PO# 4524229716 Holy Caruschka Zavala Figueroa ,pdf.exe")

RemcosRAT C2:
nagod.ddns.net

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.AI.Packer.7BA51BF319.27257.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/889052d8a645776eb87cc8f4544965174654aa46f4d39562aab7b825baf64a50/
Threat name:
Win32.Backdoor.NetWiredRc
Create hunting rule
Status:
Malicious
First seen:
2020-06-26 15:43:04 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rciffwfgiv3w5od4zd2fislfc5dfjksg6tjzkyvkw64cloxwjjia._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso 889052d8a645776eb87cc8f4544965174654aa46f4d39562aab7b825baf64a50

(this sample)

RemcosRAT

Executable exe a4a3167ca8c35a365a3f308cebf6169b1f771eb5094a77de23e6b0799794f135

  
Dropping
MD5 99d61423ddad6c2eb67a0e52a4c75744
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a4a3167ca8c35a365a3f308cebf6169b1f771eb5094a77de23e6b0799794f135

Comments