MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 37ed67616d219d00004f18381bc7f4cb67658173b0ecbc9d1fea71dda6d442d0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 37ed67616d219d00004f18381bc7f4cb67658173b0ecbc9d1fea71dda6d442d0
SHA3-384 hash: 8c3f1f943dac3812f83fe964327268ff059d29fcabc436071fffae9bebc81579a39a71e7fbe7068a7b20d8bc2d437496
SHA1 hash: ba7b8b6efd6a2b17ffeaed818f7d6ef1fc5dd2b5
MD5 hash: f032027db4ecea91a1f6112dcc322672
humanhash: august-mirror-mississippi-river
File name:New purchase order PO78904301541,pdf.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:712'704 bytes
First seen:2020-08-19 09:23:34 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:7m/ZNPa2c/PWwuUDKcoEwWLC2W2nKjdkOdqY55w/sPXjlBeh07D:7m/TyzPWwuUDpoEwECcKpkON/vno0
TLSH FDE49E62E6804837C1531578AC0B9FE9D937AF103B98AC477BEA2E0C5F397D17929097
Reporter abuse_ch
Tags:iso RemcosRAT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: cloudhost-107411.us-midwest-1.nxcli.net
Sending IP: 209.126.25.153
From: AEV Ltd <aev@aev.co.uk>
Subject: order inquiry
Attachment: New purchase order PO78904301541,pdf.iso (contains "New purchase order PO#78904301541,pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/37ed67616d219d00004f18381bc7f4cb67658173b0ecbc9d1fea71dda6d442d0/
Threat name:
Win32.Trojan.Delf
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 09:30:07 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=g7wwoylnegoqaacpda4bxr7uzntwlaltwdwlzhi75jy53jwuilia._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso 37ed67616d219d00004f18381bc7f4cb67658173b0ecbc9d1fea71dda6d442d0

(this sample)

RemcosRAT

Executable exe 1c517ddebb6f5893d52918c51a70e56f68b50dd65e0460a673cce3625a0f8a2b

  
Dropping
MD5 7704dc911d420896f07e21986aa85746
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1c517ddebb6f5893d52918c51a70e56f68b50dd65e0460a673cce3625a0f8a2b

Comments