MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b82b497c5a133e9a9bcbb1234fb288ce9a329eec3cf82a9ee2178d0f8a7c9e3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1b82b497c5a133e9a9bcbb1234fb288ce9a329eec3cf82a9ee2178d0f8a7c9e3
SHA3-384 hash: f7f7abe0b16cecf8fbeb8f42955f1af2540726b54ff4f5f43ab5b15732bbc17872e78316f9121427071f2d4c7703a465
SHA1 hash: 37d926f5203673d5ca50ece53b0a7376ba3c72b2
MD5 hash: 8432b1b33d0aa4c57cb92aef416163e0
humanhash: alpha-sweet-oxygen-batman
File name:Attached file.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'572'864 bytes
First seen:2021-03-06 18:08:49 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:+pIEyKFL1c+rhV9OREr9kk3JxamqkD6ST8KVC6:+pIErfJjD5T8KVC
TLSH 1F75AEA3F390A937D1132530991B51A5ED1A7EF0391CE44A7BE87D047F3A94D3A2AC93
Reporter abuse_ch
Tags:DHL iso RemcosRAT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.helporder.online
Sending IP: 188.93.233.213
From: Dhl Customer Support <order@helporder.online>
Subject: Delivery Failed
Attachment: Attached file.iso (contains "Document.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
370
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs1729.UNOFFICIAL
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1b82b497c5a133e9a9bcbb1234fb288ce9a329eec3cf82a9ee2178d0f8a7c9e3/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-03-06 14:55:14 UTC
AV detection:
11 of 44 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dobljf6fuez6tkn4xmjdj6zirtu2gkpoyphyfkpoef4nb6fhzhrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1b82b497c5a133e9a9bcbb1234fb288ce9a329eec3cf82a9ee2178d0f8a7c9e3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso 1b82b497c5a133e9a9bcbb1234fb288ce9a329eec3cf82a9ee2178d0f8a7c9e3

(this sample)

RemcosRAT

Executable exe 30ae97a96ff5a50bbbc7af4239ed02c07a9fb2737edd2b121c255903d855c4ff

  
Dropping
MD5 f7b4bb2e02f6d8cba4a26a58f9041891
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 30ae97a96ff5a50bbbc7af4239ed02c07a9fb2737edd2b121c255903d855c4ff

Comments