MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f06707108fd802f7eef4c2366f9d50343d66590cae38a3a91e9cda277c0e493. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1f06707108fd802f7eef4c2366f9d50343d66590cae38a3a91e9cda277c0e493
SHA3-384 hash: 73d07113417f92763d378e660cd3db73ccb2514e7d95ad34036da17c6a997db0fa3154b6c73ba1861e08c960d16b3711
SHA1 hash: b6d6154c0e5336be350a9eab8da656b717b86340
MD5 hash: 03e52f759bf76f442f284df8aae190b3
humanhash: fanta-quiet-wolfram-sweet
File name:UPS_attachment.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'638'400 bytes
First seen:2020-05-04 22:18:40 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:zgTfvH5kDYtfLWyfhcEwyzdz5Ik5Zt5s:zgTffS1sOcz5I
TLSH 3A757D22A253DA37D12355389D7B56B8E836BE136F6858472AF52C3C1FF93403837296
Reporter abuse_ch
Tags:iso RAT RemcosRAT UPS


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: ours2.westcentralus.cloudapp.azure.com
Sending IP: 52.161.111.211
From: UPS Customer Service <customer@ups.com>
Subject: UPS - Pending delivery
Attachment: UPS_attachment.iso (contains "readme.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Zusy.302747.15832.15474.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Delf
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 19:29:52 UTC
File Type:
Binary (Archive)
Extracted files:
88
AV detection:
16 of 30 (53.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=d4dha4ii7wac67xpjqrwn6ovanb5mzmqzlryuour5hg2e56a4sjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso 1f06707108fd802f7eef4c2366f9d50343d66590cae38a3a91e9cda277c0e493

(this sample)

RemcosRAT

Executable exe 58421a1f4ace3bf3d22cc6133e1eee78253cebf89262eebe0d14423c4552a2c7

  
Dropping
MD5 114a85e912f3453e2ae5854f641bdf07
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 58421a1f4ace3bf3d22cc6133e1eee78253cebf89262eebe0d14423c4552a2c7

Comments