MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 24f4cf4250300c826fb80e2aebdd9e413f56d9ec5eda5fd5214e4dad9b517002. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 24f4cf4250300c826fb80e2aebdd9e413f56d9ec5eda5fd5214e4dad9b517002
SHA3-384 hash: 68ed81006504131e8fc96a51c21eb04d7177104c17e23f91f708dbb5ad54cb5389c80327829b7e1b5c59b4e180c02ef9
SHA1 hash: 6f59efa8135bac80ce917477498baef0db018826
MD5 hash: 4b01efab6972b7898af7e0eb62716a77
humanhash: princess-bravo-gee-earth
File name:Attachment.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'638'400 bytes
First seen:2021-04-08 15:50:08 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:eAbYaqS0wo6olyeUHL6j1vgoHg0XWidwuRIKYd6pKWeWdTcYWGlddHlgU/OyV:eS8wo6oljrBneWKPIddHlgUDV
TLSH 9775AF12B293D032D06217395C6AF27C8822BFA17DD4648B76E43F4F9F761D17829A87
Reporter abuse_ch
Tags:DHL iso RemcosRAT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.orderissued.xyz
Sending IP: 75.119.154.209
From: Dhl Customer Support <mail@orderissued.xyz>
Subject: Delivery Failed
Attachment: Attachment.iso (contains "Document.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
245
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs1729.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/24f4cf4250300c826fb80e2aebdd9e413f56d9ec5eda5fd5214e4dad9b517002/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-04-08 16:00:56 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=et2m6qsqgagie35ybyvoxxm6ie7vnwpml3nf7vjbjzg23g2roaba._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/24f4cf4250300c826fb80e2aebdd9e413f56d9ec5eda5fd5214e4dad9b517002

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso 24f4cf4250300c826fb80e2aebdd9e413f56d9ec5eda5fd5214e4dad9b517002

(this sample)

RemcosRAT

Executable exe 84f9e8abd4682870a94655c297e283b12de8162454217deb5d56d33603a04b35

  
Dropping
MD5 2b087560bc75a3f809da01876c3410dd
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 84f9e8abd4682870a94655c297e283b12de8162454217deb5d56d33603a04b35

Comments