MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be29287a43498b9d3762e530f25e826654ac25c5eb87723c34c44d3ddd888adb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: be29287a43498b9d3762e530f25e826654ac25c5eb87723c34c44d3ddd888adb
SHA3-384 hash: 4bcb34654931a5ee461b1504e7d3ba1d1b0222222bca46979bc9a7c5960efdeafb16cd94e088bdf6ac4a338378a1cbb8
SHA1 hash: 0ab0415a3dfe22287c578b437537f242acfd3f3d
MD5 hash: 6f13e3320be9bd460ef515fb6575f4c7
humanhash: tango-six-edward-mars
File name:Att PI20200206AP,pdf.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:438'272 bytes
First seen:2020-06-25 08:16:10 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:5ILjgNaUqn2KYzbdjgjLnhSu9fN/T4rxIvb4Ke9k/tjNr:5IoNMn29zbVgBF0xIMKe98tB
TLSH 3794AD84FA445665CD6C87751172C97013377CAA6131E60E3DCE3EAB3FB7B928122A63
Reporter abuse_ch
Tags:iso RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: host.eclicsys.org
Sending IP: 45.79.145.22
From: Eduardo Gomez <1c30@lefarma.com.mx>
Subject: RE: PI20200206AP
Attachment: Att PI20200206AP,pdf.iso (contains "Att PI20200206AP,pdf.exe")

RemcosRAT C2:
nagod.ddns.net:8811 (216.38.7.231)

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject3.44022.26029.17820.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/be29287a43498b9d3762e530f25e826654ac25c5eb87723c34c44d3ddd888adb/
Gathering data
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xyusq6sdjgfz2n3c4uypexucmzkkyjof5odxepbuyrgt3xmirlnq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso be29287a43498b9d3762e530f25e826654ac25c5eb87723c34c44d3ddd888adb

(this sample)

RemcosRAT

Executable exe 6e81166c1dea33469469446a37bcbe6977c337b15444889f77cad0828e497f18

  
Dropping
MD5 db620710540ecee16a9b9f7bde7c34b7
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6e81166c1dea33469469446a37bcbe6977c337b15444889f77cad0828e497f18

Comments