MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 49ddc5fe70bb5803edaee2e2bf078f9041d6a238d52ba433de9b507858d81adb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 49ddc5fe70bb5803edaee2e2bf078f9041d6a238d52ba433de9b507858d81adb
SHA3-384 hash: 656d030c35057e51eaaeeb0ceac04980a1cf7873612a76ee79f84a1b0e159537e30a2b5c31787981ad51cc72a75eb4b3
SHA1 hash: 209d547ba109e7858c4ee91ca475a09202334540
MD5 hash: d19ac64774f9158009b84c3c2a6dc81b
humanhash: enemy-two-indigo-connecticut
File name:Attachment.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'245'184 bytes
First seen:2022-08-29 08:19:26 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 3072:zda1UXkUBqRWVH2I8WqxOobnzF37I3w7kEMnkxrkGf7Nn0gDYZXgZtc181VZtYAn:zdkfUHH2I0xOoF7eTiDMkZ9SN2fL62
TLSH T1C945292430411736E2B4A7FE1567847C27EEA60EA4DADB841E46C8DC3A20F9617D2F97
TrID 99.6% (.NULL) null bytes (2048000/1)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
0.0% (.SMT) Memo File Apollo Database Engine (88/84)
Reporter cocaman
Tags:DHL iso RemcosRAT


Avatar
cocaman
Malicious email (T1566.001)
From: "dhl@postesmailing.com" (likely spoofed)
Received: "from vmi983549.contaboserver.net (vmi983549.contaboserver.net [207.180.205.43]) "
Date: "Mon, 22 Aug 2022 09:23:52 -0700"
Subject: "DHL Delivery Failed - THE SCHEDULED DELIVERY OF YOUR PACKAGE HAS BEEN
UPDATED "
Attachment: "Attachment.iso"

Intelligence

File Origin
# of uploads :
1
# of downloads :
214
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Porcupine.Unclassified.233494.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed remcos warp
Link:
https://www.filescan.io/uploads/630c76d25b45ec20ccd54c34/reports/34f56735-cffe-4cd2-869b-75163d103d2f/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/49ddc5fe70bb5803edaee2e2bf078f9041d6a238d52ba433de9b507858d81adb/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-08-22 17:55:37 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
16 of 26 (61.54%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jho4l7tqxnmah3no4lrl6b4psba5niry2uv2im66tnihqwgydlnq._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220829-j8fpdsecbq/
Behaviour
Modifies system certificate store
Suspicious use of AdjustPrivilegeToken
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/49ddc5fe70bb5803edaee2e2bf078f9041d6a238d52ba433de9b507858d81adb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso 49ddc5fe70bb5803edaee2e2bf078f9041d6a238d52ba433de9b507858d81adb

(this sample)

RemcosRAT

Executable exe 146e9314dabcad733e15ab5e796c53fda2be2b34ea00a0bc03efda9ea674202f

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 146e9314dabcad733e15ab5e796c53fda2be2b34ea00a0bc03efda9ea674202f
  
Dropping
RemcosRAT

Comments