MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 33050792ac86e7e40818bc2014d049cd5434579b86362d65c85a897385b1f5e7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 33050792ac86e7e40818bc2014d049cd5434579b86362d65c85a897385b1f5e7
SHA3-384 hash: 02bcfa87c4179db2a8bac2484d38b0c6b427a42ce810afe0f4b3d6347fee0a8a432acf73c5ab0fb5a3f9f1225d9242a4
SHA1 hash: de1b4e2669a92d4e09927cec341077c156afb340
MD5 hash: a8aa1e56401255038582edc547c53e67
humanhash: mike-social-glucose-foxtrot
File name:UPS Detail.img
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'245'184 bytes
First seen:2020-10-18 17:11:32 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:AS9EXB2rnxBTPrv45rdrHJfZF/BveAt7hei6tZ0KeoPRiR44ngPwAYUJNreqCcAz:3lxpPOrNBbBlhwa0RQ42y1J9Arwk
TLSH 6645BE2A1A05AF14E17D5377D0D40424D3FEDC47E322C5AABEF832CE4696F986663B06
Reporter abuse_ch
Tags:img nVpn RAT RemcosRAT UPS


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: mysmtp4
Sending IP: 52.247.209.58
From: UPS Customer Service <pkinfo@ups.com>
Subject: UPS - Package Arrival Notification
Attachment: UPS Detail.img (contains "maL634DHQGpEwYR.exe")

u875414.nsupdate.info
u875414.nvpn.to
u875414.duckdns.org
u875414.ddns.net

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.749.14482.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/33050792ac86e7e40818bc2014d049cd5434579b86362d65c85a897385b1f5e7/
Threat name:
ByteCode-MSIL.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-10-18 14:07:06 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gmcqpevmq3t6icayxqqbjucjzvkdiv43qy3c2zoilkexhbnr6xtq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/33050792ac86e7e40818bc2014d049cd5434579b86362d65c85a897385b1f5e7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

img 33050792ac86e7e40818bc2014d049cd5434579b86362d65c85a897385b1f5e7

(this sample)

RemcosRAT

Executable exe bd4ef5e45ec6e18bc4fc2225588ea4d01151f8f82aeb073a75868bdbcfc66b5a

  
Dropping
MD5 e6959f4b669656929b46353359a37b14
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bd4ef5e45ec6e18bc4fc2225588ea4d01151f8f82aeb073a75868bdbcfc66b5a

Comments