MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0f60cbda257ca7087fe04c518162d1cde7f7a8614b81e67f1fc0469ec944aa32. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0f60cbda257ca7087fe04c518162d1cde7f7a8614b81e67f1fc0469ec944aa32
SHA3-384 hash: 0f310840ea2ed104a031f5b8a86da4d93f0f324a2b10a5a255d1ba4b1c6e7fe17e1ff7dc13f5b0772f40da3717052faa
SHA1 hash: 98ac2d540b14f907d445fb9abd8d732ed006a79f
MD5 hash: bbefe5b0b79b883e826793744282abe9
humanhash: mexico-louisiana-mike-batman
File name:Quotation 77028_20210305.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'245'184 bytes
First seen:2021-03-05 13:07:35 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:Soq8teodM4fNDVbUs2yxe1jEkwWO5QBe1XTLFbI:OyWO5Q01XP2
TLSH BE45C5EDC04E50EDD4B27BF13BA55C1C93567E116A2AA01A24447D833FBF9A2BB43816
Reporter abuse_ch
Tags:iso RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: slot0.julislinq.com
Sending IP: 194.31.96.36
From: Sales01 - PURCHASE <sales@julislinq.com>
Subject: RFQ/2021/03/05/Quotation/NEW ORDER/77028_2021030 APRIL DELIVERY 07
Attachment: Quotation 77028_20210305.iso (contains "mn9VCjzNP8ATu3F.exe")

RemcosRAT C2:
sandshoe.myfirewall.org

Intelligence

File Origin
# of uploads :
1
# of downloads :
321
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.24207.4093.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0f60cbda257ca7087fe04c518162d1cde7f7a8614b81e67f1fc0469ec944aa32/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-05 13:08:12 UTC
AV detection:
10 of 47 (21.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=b5qmxwrfpstqq77ajriycywrzxt7pkdbjoa6m7y7ybdj5skeviza._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.98
Link:
https://yomi.yoroi.company/submissions/0f60cbda257ca7087fe04c518162d1cde7f7a8614b81e67f1fc0469ec944aa32

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso 0f60cbda257ca7087fe04c518162d1cde7f7a8614b81e67f1fc0469ec944aa32

(this sample)

RemcosRAT

Executable exe 647bdf2171bb254e9d42588d2f58c26d7057daf80da8cd1ec70bb89d71b4d47a

  
Dropping
MD5 c246f904d06dde69c6f2740ff1e19925
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 647bdf2171bb254e9d42588d2f58c26d7057daf80da8cd1ec70bb89d71b4d47a

Comments