MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5ba9de1f282be183441a5112a7bae506932922f435c2ac75c0f9621d02b99bb5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5ba9de1f282be183441a5112a7bae506932922f435c2ac75c0f9621d02b99bb5
SHA3-384 hash: 3424a16a644b8ff4893259068360fce36fc2a1117aeaa1c6d62ee504916bcc423100991a761f360a4a2f0218a5e68475
SHA1 hash: f601778426f6c1929c1cddaf199645d21beb0505
MD5 hash: 9e72f511be512ba7d2f02ee56beb4f44
humanhash: gee-twenty-fanta-stairway
File name:SOA - NCL INTER LOGISTICS.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:667'648 bytes
First seen:2021-02-09 18:53:27 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:mMmy0qSqT0hq+qHqBU6sGTofApII5SCrp3qEk9y8D:0O6pnSSMyS
TLSH CDE46B5633586F2AF1BEA3B9D0250470A3F5EE26E325EB8F3E9C30CA4675F44D615602
Reporter abuse_ch
Tags:iso RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: mail3.ferotrade.ch
Sending IP: 64.227.105.215
From: Liwoi Accounts NCLSIN < info@saerdsae.xyz >
Subject: RECORDATORIO DE PAGO - SOA - Excepcional (21 DE ENERO)
Attachment: SOA - NCL INTER LOGISTICS.iso (contains "SOA - NCL INTER LOGISTICS.exe")

RemcosRAT C2:
zimchi2021.ddns.net:1990 (64.227.105.215)

Intelligence

File Origin
# of uploads :
1
# of downloads :
123
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.537.25834.18737.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5ba9de1f282be183441a5112a7bae506932922f435c2ac75c0f9621d02b99bb5/
Threat name:
ByteCode-MSIL.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-02-09 18:54:08 UTC
AV detection:
7 of 47 (14.89%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lou54hzifpqygra2kejkpoxfa2jssixugxbky5oa7frb2avzto2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/5ba9de1f282be183441a5112a7bae506932922f435c2ac75c0f9621d02b99bb5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso 5ba9de1f282be183441a5112a7bae506932922f435c2ac75c0f9621d02b99bb5

(this sample)

RemcosRAT

Executable exe bb565cb82988981590cf413b076eb8c1a95ae230079df273f00151f1e56edc24

  
Dropping
MD5 27b7c80b7b2fa16b509bb5a693082e44
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bb565cb82988981590cf413b076eb8c1a95ae230079df273f00151f1e56edc24

Comments