MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 29d70014fa089c332c000207e2a5f71827b8a9562ac5a3c40060d78f79a32c92. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 29d70014fa089c332c000207e2a5f71827b8a9562ac5a3c40060d78f79a32c92
SHA3-384 hash: 92f92ea0df098c1281fa3ea1d34444c77f468d6e9b4543c29073cb235537ab06d9ddee7b12b0ea13354e30674496b569
SHA1 hash: 8cd809fa19ee05a15ed9719f4000546bc23d2292
MD5 hash: bc5fae320483cb3049c7622aeef615b0
humanhash: quiet-maine-uranus-helium
File name:DHL Delivery document 1190409526, pdf.zip
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:473'765 bytes
First seen:2020-10-20 08:33:21 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:Ywn6wB1jjeurN509rb+hDxytF9XfU5A2GrN:Yw6wBFjpf09GrytfX1x
TLSH 74A423C09E8895C4E7700AD9A4425CFF7FEBC32605E5EFA086B64A91E086E5F5030F72
Reporter abuse_ch
Tags:DHL RAT RemcosRAT zip


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: vps.knei-ttrati.com
Sending IP: 45.95.169.151
From: DHL Express Cargo <delivery@dhl.com>
Subject: RV: DHL CARGO DELIVERY
Attachment: DHL Delivery document 1190409526, pdf.zip (contains "DHL Delivery document 1190409526, pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/29d70014fa089c332c000207e2a5f71827b8a9562ac5a3c40060d78f79a32c92/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fhlqafh2bcodglaaaid6fjpxdat3rkkwflc2hraamdly66ndfsja._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Remcos
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/29d70014fa089c332c000207e2a5f71827b8a9562ac5a3c40060d78f79a32c92

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip 29d70014fa089c332c000207e2a5f71827b8a9562ac5a3c40060d78f79a32c92

(this sample)

RemcosRAT

Executable exe b29880b2403337ef4fb3c644c4b033327cb6e2828d28799a0cc6a708cc0afaa4

  
Dropping
MD5 c74a434c9d1068b1afd0bd77450ace57
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b29880b2403337ef4fb3c644c4b033327cb6e2828d28799a0cc6a708cc0afaa4

Comments