MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 08cd0e38fd6ef5a32d9b030879bfafac2b94afb2e86967c2c6cdc9c206f6395a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 08cd0e38fd6ef5a32d9b030879bfafac2b94afb2e86967c2c6cdc9c206f6395a
SHA3-384 hash: 7ab9a1e3ad3e3f7ba4111cbb927f84b97223e2f560e60fe522c0c4e2ace69c888deeac0d54f0d51cb3ac0c98ce660813
SHA1 hash: 2d34fda245a0a38f99c5168518c3e4b2949c8dff
MD5 hash: 4bf1a41ae90a5631f0bdd0f24bc918fe
humanhash: early-leopard-massachusetts-moon
File name:UPS_FILE.ISO
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'638'400 bytes
First seen:2020-05-04 22:40:42 UTC
Last seen:2020-05-05 08:41:57 UTC
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:kgTfvH5kDYtfLWyfhcEwyzdtmIk5ZtOs:kgTffS1sOctmI
TLSH 3F757D22A253DA37D12355389D7B56B8E836BE136F6858472AF52C3C1FF93403837296
Reporter abuse_ch
Tags:iso nVpn RAT RemcosRAT UPS


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: ours4.westcentralus.cloudapp.azure.com
Sending IP: 52.161.106.35
From: UPS Customer Service <customer@ups.com>
Subject: UPS - Pending delivery
Attachment: UPS_FILE.ISO (contains "details.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Zusy.302747.15832.15474.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Delf
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 23:35:23 UTC
File Type:
Binary (Archive)
Extracted files:
88
AV detection:
16 of 31 (51.61%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bdgq4oh5n322glm3amehtp5pvqvzjl5s5buwpqwgzxe4ebxwhfna._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso 08cd0e38fd6ef5a32d9b030879bfafac2b94afb2e86967c2c6cdc9c206f6395a

(this sample)

RemcosRAT

Executable exe 6e10d24d51ab300669a5980acfbb9589f16246ee81c6aab569fde0725390e1e1

  
Dropping
MD5 4c8aa17db8e8e025c3668d46a877dedf
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6e10d24d51ab300669a5980acfbb9589f16246ee81c6aab569fde0725390e1e1

Comments