MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd6f658bfcce9761fbe539a7bff72f23446ad5d7653914fa013b04dce03c0953. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fd6f658bfcce9761fbe539a7bff72f23446ad5d7653914fa013b04dce03c0953
SHA3-384 hash: c0be59b7e2d8c7e9598e309b74b6d90e8e2a98148c6940543caaf49b0883c7e660a8a941fba1631974ef840b423334e7
SHA1 hash: 5451d86fe5015e077c867da5f31bb1e7e6416318
MD5 hash: 3d6c290b214a45649bb8ae6a7e70bae5
humanhash: red-shade-north-indigo
File name:parcel.r20
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:458'646 bytes
First seen:2020-08-18 19:16:11 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:PvAdklJJ+zksTp9HoO9yZOAsoZsER1eUSOmsxCWgAA:X+QUp9HV9RABFR1hSOmsx3gh
TLSH EEA423877DB9996814CBC3E6228F776DE9ED70A6072F47B93AFC619B0B00129C15C523
Reporter abuse_ch
Tags:DHL r20 RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: server1.englam.com.sg
Sending IP: 103.11.189.83
From: DHL International GmbH <email@varizon.biz>
Subject: DHL Shipment Arrival Notification
Attachment: parcel.r20 (contains "parcel.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fd6f658bfcce9761fbe539a7bff72f23446ad5d7653914fa013b04dce03c0953/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 19:18:05 UTC
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7vxwlc74z2lwd67fhgt375zpencgvvoxmu4rj6qbhmcnzyb4bfjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/fd6f658bfcce9761fbe539a7bff72f23446ad5d7653914fa013b04dce03c0953

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar fd6f658bfcce9761fbe539a7bff72f23446ad5d7653914fa013b04dce03c0953

(this sample)

RemcosRAT

Executable exe 21c0f71a640ec97eb4bf4e3445896f1200e676bc8c2c096db8a725d5eb6f3427

  
Dropping
MD5 694b31179e7f041ac22e1a16909e11a0
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 21c0f71a640ec97eb4bf4e3445896f1200e676bc8c2c096db8a725d5eb6f3427

Comments