MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 00d0dcc155b889107ad32e90f8172490dc32280cc62e762bfa5e7deecea1099d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 00d0dcc155b889107ad32e90f8172490dc32280cc62e762bfa5e7deecea1099d
SHA3-384 hash: 841186341e11e89e8b17dd8567126adee652e1f9b3a1f6c722316fb5240727dd9329e5f78d2efb6986f335a40fd90004
SHA1 hash: c142d74d6d585550af9d810f73faa8418d6045a5
MD5 hash: e04d958c16df00046fe516e6ea187321
humanhash: river-four-magazine-social
File name:attach-file.img
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'376'256 bytes
First seen:2021-11-26 06:43:40 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:I+3V1iARDZ1Wv7GFdc6v8cnr3pB7PeDhxYjAKJtWcpEL36U:I+FrZ1Wv74d9lTrbeDhmxJtWf36U
TLSH T1AF555B11B2919C72C1771679DC3BB6A45F39BE806AF47D963EE439480FB8381742E392
Reporter cocaman
Tags:DHL img RemcosRAT


Avatar
cocaman
Malicious email (T1566.001)
From: "DHL Express <info@dhlxpres.com>" (likely spoofed)
Received: "from postfix-inbound-v2-5.inbound.mailchannels.net (inbound-egress-6.mailchannels.net [199.10.31.238]) "
Date: "Fri, 26 Nov 2021 01:07:33 +0800"
Subject: "On Demand Delivery"
Attachment: "attach-file.img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
152
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

SecuriteInfo.com.Malware.AI.3961113016.25418.17593.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
67%
Tags:
keylogger
Link:
https://www.filescan.io/uploads/61a08235f36138de3f3e4c10/reports/b2c0c753-a959-457c-82f0-f31cbd54543b/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/00d0dcc155b889107ad32e90f8172490dc32280cc62e762bfa5e7deecea1099d/
Threat name:
Win32.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2021-11-25 17:11:55 UTC
File Type:
Binary (Archive)
Extracted files:
49
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=adinzqkvxcera6wtf2ipqfzesdodekamyyxhmk72lz665tvbbgoq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/00d0dcc155b889107ad32e90f8172490dc32280cc62e762bfa5e7deecea1099d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

img 00d0dcc155b889107ad32e90f8172490dc32280cc62e762bfa5e7deecea1099d

(this sample)

RemcosRAT

Executable exe a00a856f0d85fcb7f485777ae81a0b1c52974bb1cd2482ba5e987a7ce8207511

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a00a856f0d85fcb7f485777ae81a0b1c52974bb1cd2482ba5e987a7ce8207511
  
Dropping
RemcosRAT

Comments