MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 42a724e8cf11c9b1fdc86b3e91b320c7654ff1e951e9607ba1409ecd2e87c2ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 42a724e8cf11c9b1fdc86b3e91b320c7654ff1e951e9607ba1409ecd2e87c2ab
SHA3-384 hash: 9d695b1eba24a4d32771dca38fb6495f3d1a9c0b222bf5253bd60cce583cef031729a9b1223f45f0a1ca85e4a9560a46
SHA1 hash: ba969681a25a8b8e547f945c8e37d4c6a0f20a66
MD5 hash: e00d360b864845f905bf5eeedd1eb0c7
humanhash: mobile-orange-monkey-king
File name:Payment Invoice PDF.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:606'208 bytes
First seen:2021-01-21 06:20:07 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:j0ECo42Y1e0LwY21xRlpaoUqhA8nWNMe2jJ+KeGQo4kp:j0pgYUGwN1xjpao1WNmxeho
TLSH 2ED4011673989F65E0FE9BB426B5110003F7F215A772DB1E7ECC60A82BB3B50C516B4A
Reporter abuse_ch
Tags:iso RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: vps.asswart.com
Sending IP: 45.85.90.28
From: Jainson Naik <office@briglum.com>
Subject: Payment terms
Attachment: Payment Invoice PDF.iso (contains "Payment Invoice PDF.exe")

RemcosRAT C2:
mikegrace2021.ddns.net

Intelligence

File Origin
# of uploads :
1
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs1570.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/42a724e8cf11c9b1fdc86b3e91b320c7654ff1e951e9607ba1409ecd2e87c2ab/
Threat name:
Win32.Trojan.Zmutzy
Create hunting rule
Status:
Malicious
First seen:
2021-01-21 02:42:44 UTC
AV detection:
13 of 46 (28.26%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=iktsj2gpche3d7oinm7jdmzay5su74pjkhuwa65bicpm2luhykvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Backdoor
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/42a724e8cf11c9b1fdc86b3e91b320c7654ff1e951e9607ba1409ecd2e87c2ab

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso 42a724e8cf11c9b1fdc86b3e91b320c7654ff1e951e9607ba1409ecd2e87c2ab

(this sample)

RemcosRAT

Executable exe 8084639a37257615b09beac5c8f681aa2115ece62fcb003fc8ddadb0d833fdb7

  
Dropping
MD5 d0cf67cc18970f999e6fb9fad2f96493
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8084639a37257615b09beac5c8f681aa2115ece62fcb003fc8ddadb0d833fdb7

Comments