MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 14e15288c863fd7a11a8054c311714fe788640a695e6e97db824617799e1920e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 14e15288c863fd7a11a8054c311714fe788640a695e6e97db824617799e1920e
SHA3-384 hash: eae62bdb3f1b69e1955a0d3bad37a269f729337a9015a5d216f529fbcf17d5c181b91a67e570cce019f609688cefe83d
SHA1 hash: 447e0e0e3e3001e5287d173a60e649b7ec7012d8
MD5 hash: 2cd83ef32c163d0581157b22dd8c46a8
humanhash: alaska-eighteen-zulu-jupiter
File name:Shipping document PL and BL0070,pdf.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'228'800 bytes
First seen:2020-12-21 07:35:45 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:ElFevDYCo7vaMqsNwiyUNnYf5J5pPAJpN:EzaPo74YwmeLAJn
TLSH 1D45BE243EEA501DF273AF755AE47596CAAFF6733B03E45E2084038A4713A41DE9263D
Reporter abuse_ch
Tags:DHL iso RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: mail2.promptcheng.com
Sending IP: 164.90.152.139
From: DHL Express <delivery@dhl.com>
Subject: Your DHL Delivery exception -Friday, December 18, 2020
Attachment: Shipping document PL and BL0070,pdf.iso (contains "Shipping document PL and BL0070,pdf.exe")

RemcosRAT C2:
graceman2021.ddns.net

Intelligence

File Origin
# of uploads :
1
# of downloads :
116
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_badexts72.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/14e15288c863fd7a11a8054c311714fe788640a695e6e97db824617799e1920e/
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-12-21 00:24:40 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ctqvfcgimp6xueniavgdcfyu7z4imqfgsxtos7nyerqxpgpbsiha._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/14e15288c863fd7a11a8054c311714fe788640a695e6e97db824617799e1920e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso 14e15288c863fd7a11a8054c311714fe788640a695e6e97db824617799e1920e

(this sample)

RemcosRAT

Executable exe 09ae45bfdc397f7e2cdae3acf93e09d253162d417aa46de732feb4b9018edc4e

  
Dropping
MD5 dba6b3d74d75ba18c04741c7ba6f856c
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 09ae45bfdc397f7e2cdae3acf93e09d253162d417aa46de732feb4b9018edc4e

Comments