MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 03c9cca134170890bcb20f0e690fe65d9cd9a9477dfe5db7e2d2f22ed4a776ce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 03c9cca134170890bcb20f0e690fe65d9cd9a9477dfe5db7e2d2f22ed4a776ce
SHA3-384 hash: a479c627a5d46f718114de10344dab5e050adf6b13f5695512c3e41ca35fa64f02c1d247652f5b8e53fb1afcebae493b
SHA1 hash: f6fa410a3c015bd38b9f98d1aa58159c34860bfe
MD5 hash: dd124b7190aa12f076c730807b844691
humanhash: burger-spring-seven-coffee
File name:New order.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'245'184 bytes
First seen:2021-01-14 06:57:52 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:AF0f3sHOmVYAO3YANcEwXZtBsJr2Y40kAOT6WArShIiSB2PYI7Y:A2fYfWwp7y2eOT7gS6wwk
TLSH 7E4519DE12F1006BD12945B4A999EFE05560FC787B61C226BE84FCCEAF313E154622F6
Reporter abuse_ch
Tags:Hostwinds iso RemcosRAT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: hwsrv-824517.hostwindsdns.com
Sending IP: 23.238.43.35
From: imports@welfare.top
Subject: Request For Quotation And Price Listing
Attachment: New order.iso (contains "orders2.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
140
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Strictor.105210.10740.26993.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/03c9cca134170890bcb20f0e690fe65d9cd9a9477dfe5db7e2d2f22ed4a776ce/
Threat name:
Win32.Trojan.Strictor
Create hunting rule
Status:
Malicious
First seen:
2021-01-14 06:58:14 UTC
AV detection:
11 of 46 (23.91%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ape4zijuc4ejbpfsb4hgsd7glwontkkhpx7f3n7c2lzc5vfho3ha._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/03c9cca134170890bcb20f0e690fe65d9cd9a9477dfe5db7e2d2f22ed4a776ce

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso 03c9cca134170890bcb20f0e690fe65d9cd9a9477dfe5db7e2d2f22ed4a776ce

(this sample)

RemcosRAT

Executable exe 20cc3f25b59d83cbfd3f6908726114e8b0442907fabfc58da5f1eee4ae2ece81

  
Dropping
MD5 3d4d8630f3f0080bed661797ad1f21a8
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 20cc3f25b59d83cbfd3f6908726114e8b0442907fabfc58da5f1eee4ae2ece81

Comments