MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 59a9c2adc18519ec2ec9d6550e632532b84be15fa21e8e12f1100de642cac1fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 59a9c2adc18519ec2ec9d6550e632532b84be15fa21e8e12f1100de642cac1fa
SHA3-384 hash: 4bc8223de3614fcaad935ab49f25a31ce30e6fe8eb822c934bfed3c92338692cb6f9733752a07a7f293765d32de3bc45
SHA1 hash: 0b19e89ef03431deabdd9fe9922195f0b8034b0f
MD5 hash: 442e4f58eb48d740586ebcb98aba2f6e
humanhash: cup-california-july-river
File name:PI900007417864AP,pdf.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:655'360 bytes
First seen:2020-07-21 18:36:27 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:1+TGguiLoDvM28GP22ebAmvt5w4gSuo+jMyRw6TB69SS2RJN1zzF6BL3TjvD0VjG:1+TGgF2i2Ax5w4co+18QrN1z+DV
TLSH 95D46B00FBF485C6D3AA1F7AD47101009671F95AABE6E38B3B88F2AD59533598743F12
Reporter abuse_ch
Tags:iso RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: cloudhost-75870.us-west-1.nxcli.net
Sending IP: 173.249.144.227
From: Cientifica Senna <info@cientiflcasenna.com>
Subject: RE: PI900007417864AP
Attachment: PI900007417864AP,pdf.iso (contains "PI900007417864AP,pdf.exe")

RemcosRAT C2:
nagod1.ddns.net:8811

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.GenKryptik.EOQO.19475.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/59a9c2adc18519ec2ec9d6550e632532b84be15fa21e8e12f1100de642cac1fa/
Threat name:
ByteCode-MSIL.Backdoor.Rescoms
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 18:38:06 UTC
AV detection:
12 of 29 (41.38%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lgu4flobqum6ylwj2zkq4yzfgk4exyk7uipi4exrcag6mqwkyh5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso 59a9c2adc18519ec2ec9d6550e632532b84be15fa21e8e12f1100de642cac1fa

(this sample)

RemcosRAT

Executable exe 28e5fa8a71a61c9a963340efa4179b8e1e966eca430c77f86c5795a28b66162a

  
Dropping
MD5 14d32ba4e177e8b4886a2125b421f948
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 28e5fa8a71a61c9a963340efa4179b8e1e966eca430c77f86c5795a28b66162a

Comments