MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 37343cd0974d2752a0b4d31d75a6e9e3f6bf7a0b9dde0c340775fb45cd590b6d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 37343cd0974d2752a0b4d31d75a6e9e3f6bf7a0b9dde0c340775fb45cd590b6d
SHA3-384 hash: 2de6890b42c44dc7a3c36fd97e287364781b3135f8c06420ed5c684880d8b63f682a9afd3946dadfb183ce634734ffb0
SHA1 hash: ffa08be174f7f99d4936c10cffc943210aa6da64
MD5 hash: 5489e41fdeb98ead5f1e327fadabe5dd
humanhash: equal-alaska-fifteen-emma
File name:DHL 3374687886,PDF.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'058'816 bytes
First seen:2021-01-13 07:40:50 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:HZu3dC1rze/cLLNL+g0FpXfnicUOpTfL:HiUze/c3J+FpPdTR
TLSH 8D35F840BBD85700F3BD27BC693040615BF6BB95A7B8F31CF86C506A5BA2D5084BE762
Reporter abuse_ch
Tags:DHL geo iso RAT RemcosRAT VNM


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: mail2.brandsloveki.com
Sending IP: 164.90.147.2
From: DHL Express<delivery@dhl.com>
Subject: RV: Thông báo Vận chuyển DHL Express
Attachment: DHL 3374687886,PDF.iso (contains "DHL 3374687886,PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
178
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_badexts72.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/37343cd0974d2752a0b4d31d75a6e9e3f6bf7a0b9dde0c340775fb45cd590b6d/
Threat name:
ByteCode-MSIL.Trojan.Zmutzy
Create hunting rule
Status:
Malicious
First seen:
2021-01-13 05:18:54 UTC
AV detection:
6 of 46 (13.04%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=g42dzuexjutvfifu2moxljxj4p3l66qltxpaynahox5ultkzbnwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/37343cd0974d2752a0b4d31d75a6e9e3f6bf7a0b9dde0c340775fb45cd590b6d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso 37343cd0974d2752a0b4d31d75a6e9e3f6bf7a0b9dde0c340775fb45cd590b6d

(this sample)

RemcosRAT

Executable exe 7c7f99d2b695777b5809dcee0723304b77a06ea8c72ec8a9e0967e4d8584d585

  
Dropping
MD5 01856ddc0973cc04929480b93139ffa5
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7c7f99d2b695777b5809dcee0723304b77a06ea8c72ec8a9e0967e4d8584d585

Comments