MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 28760562bf7bced42f8f5841472168b746891aeb9943cc82d899c01af58dc7ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 28760562bf7bced42f8f5841472168b746891aeb9943cc82d899c01af58dc7ba
SHA3-384 hash: 5bc650a0c835215f421f4041728812312624da7c76c8c97f07f5239a356b58ebb6be0b7e52ccc414ac7d514ac57c59cc
SHA1 hash: 9ed0f46d19d37c8c5b2c28b45b1cd1deb61dc3f0
MD5 hash: 9051fa3baa86d1594b9bf294aeda7c96
humanhash: uniform-ack-oxygen-north
File name:PO_1012_678_91.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'245'184 bytes
First seen:2021-03-10 18:53:25 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:W+DWF7hQmhH0GEIGx11oLa0KupcBNYDm:W+DG7hAfGLa/upcp
TLSH E945BED01B7C15A2F7528F7B343B09256DA617AA041BF811FBEDB09A1A2D73C80FD685
Reporter abuse_ch
Tags:iso nVpn RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: hexi.dotvndns.com
Sending IP: 112.213.89.73
From: Monique Viramontes <duong.phan@apustech.vn>
Subject: PO_1012_678_91
Attachment: PO_1012_678_91.iso (contains "PO_1012_678_91.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
166
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs2576.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-03-10 18:44:09 UTC
AV detection:
13 of 47 (27.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fb3akyv7pphnil4plbauoiliw5disgxltfb4zawythabv5mny65a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/28760562bf7bced42f8f5841472168b746891aeb9943cc82d899c01af58dc7ba

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso 28760562bf7bced42f8f5841472168b746891aeb9943cc82d899c01af58dc7ba

(this sample)

RemcosRAT

Executable exe 145d6344c2e986f5664cee8686ff5d4cdf8cbff0466f3dee20f3a51d5714fb1e

  
Dropping
MD5 21ee675a3fffdd41be89941f643443ed
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 145d6344c2e986f5664cee8686ff5d4cdf8cbff0466f3dee20f3a51d5714fb1e

Comments