MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 08316945aa78add33c570fa355ca08b012bb08c9d87f1f8121a8de18ff1b5b86. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 08316945aa78add33c570fa355ca08b012bb08c9d87f1f8121a8de18ff1b5b86
SHA3-384 hash: bb63e38c8e117a1ee3fc5853a9d5a16c572431eeec59f9437d692135df9af6fb09fab3161f990ad54877f3bf545f8218
SHA1 hash: 46397b23f39ec99a53daa3e6f8fb6d26166144f3
MD5 hash: 0a392538759eb073131075f07ff131a2
humanhash: river-timing-fruit-lamp
File name:ILPEA_MRC2021751030XMY,pdf.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:792'576 bytes
First seen:2021-02-01 12:15:21 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:WisrdZXlPa+jC/V3oFVaUHp8K1Ly6Mx+QXX1x6tv:Wb59jC/VQaqpbnM4QVq
TLSH 89F46C6161605636F16377BDF80A069876E5B93F3D240F41DAE85A8B0B2F6C1BC4A07F
Reporter abuse_ch
Tags:iso RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: mail0.banamexbank.com
Sending IP: 128.199.251.98
From: Alfonso Bertozzi <info3@ilpea.com>
Subject: Re: Revised Order MRC20201030XMY
Attachment: ILPEA_MRC2021751030XMY,pdf.iso (contains "MIR-CAR_MRC2021751030XMY,pdf.exe")

RemcosRAT C2:
prayerarequesttojah.ddns.net:4344

Intelligence

File Origin
# of uploads :
1
# of downloads :
158
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/08316945aa78add33c570fa355ca08b012bb08c9d87f1f8121a8de18ff1b5b86/
Threat name:
Win32.Trojan.Zmutzy
Create hunting rule
Status:
Malicious
First seen:
2021-02-01 12:16:11 UTC
AV detection:
16 of 46 (34.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=baywsrnkpcw5gpcxb6rvlsqiwajlwcgj3b7r7ajbvdpbr7y3loda._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/08316945aa78add33c570fa355ca08b012bb08c9d87f1f8121a8de18ff1b5b86

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso 08316945aa78add33c570fa355ca08b012bb08c9d87f1f8121a8de18ff1b5b86

(this sample)

RemcosRAT

Executable exe 4c2583095353a9f6950be2aecdc57ce47a6acd16dfb4e9cef78134fa094c7b83

  
Dropping
MD5 5a2edb1707a0aeed55b4e32491aabccf
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4c2583095353a9f6950be2aecdc57ce47a6acd16dfb4e9cef78134fa094c7b83

Comments