MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e5c468dc264911fa90f5f993517b92000dd83ee7cb257639484ef466ef2179c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e5c468dc264911fa90f5f993517b92000dd83ee7cb257639484ef466ef2179c2
SHA3-384 hash: d8195ae51a816a2215bdf2b4dccf58aa8643e6a5feadbb86c8ee1455c656f36b5fd8630745db37d452912b58aef8dd72
SHA1 hash: 6ba270c91e01dd0e61c4abbe5d4c6e2c3d119cb2
MD5 hash: 6a2b72e8b8b7438b45e0baee7636798b
humanhash: bakerloo-quiet-pasta-triple
File name:UPS.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'966'080 bytes
First seen:2020-04-22 16:33:55 UTC
Last seen:2020-04-23 08:26:38 UTC
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:7fiNwJBKJ1CeYjoTOesmVrRG3dfaRMCHGUCNrHOI:7fiCyOUjb3aH
TLSH 56956D22F6D18837D17329389D1B97A8A92ABE103D2468477BF83D4C5F3978139352E7
Reporter cocaman
Tags:iso RemcosRAT


Avatar
cocaman
Malicious email
From: "UPS Customer Service" <customer@ups.com>
Received: from smmm3.northeurope.cloudapp.azure.com (unknown [137.135.249.56])
Date: Wed, 22 Apr 2020 15:51:56 +0000
Subject: UPS - Pending delivery
Attachment: UPS.iso

Intelligence

File Origin
# of uploads :
2
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Webalta-6854075-0
Create hunting rule

PUA.Win.Adware.Webalta-6862190-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Rescoms
Create hunting rule
Status:
Malicious
First seen:
2020-04-23 02:44:24 UTC
File Type:
Binary (Archive)
AV detection:
18 of 30 (60.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4xcgrxbgjei7vehv7gjvc64saag5qpxhzmsxmokij32gn3zbphba._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso e5c468dc264911fa90f5f993517b92000dd83ee7cb257639484ef466ef2179c2

(this sample)

RemcosRAT

Executable exe 36a40ec4deea590187112deb4f39489b2a01de2680f85504b8d59d19cee145c5

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 36a40ec4deea590187112deb4f39489b2a01de2680f85504b8d59d19cee145c5
Cape
Cape
https://www.capesandbox.com/analysis/2664/
Cape
Cape
https://www.capesandbox.com/analysis/2663/
Cape
Cape
https://www.capesandbox.com/analysis/2038/
Cape
Cape
https://www.capesandbox.com/analysis/2037/
Cape
Cape
https://www.capesandbox.com/analysis/2036/
Cape
Cape
https://www.capesandbox.com/analysis/2035/

Comments