MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 75b21b5404153ab244a1d1f54565464866dab7ca53059b3a3d2abd5dab2953b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 75b21b5404153ab244a1d1f54565464866dab7ca53059b3a3d2abd5dab2953b4
SHA3-384 hash: de912cf9f9adb53534470f86d596a514e276a33c333d9cb4ba76241cf02751f491f8b57e55425f2b16b93b773a71cbed
SHA1 hash: 497f5e3070076aa2e15c24014e38563aa6dbfe9c
MD5 hash: 644f08f87119c6f8e48d81c475d7ecd7
humanhash: bakerloo-violet-early-montana
File name:samples and quotation 68639209.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:688'128 bytes
First seen:2020-08-14 10:46:10 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:9DlzkeJ6t7VtdoWH2j+3yHdhhL+maHDe9eWvsXhjGW4w0hy+bSXEVRdtTNYFJlrU:1lzkeq7ndoWM+iaS91vvC0sNYtgHrF
TLSH 1AE45B23A1B17473C3161E388D5BABA8AC25FE143954ED4E6EE83D4C8F397813C6A157
Reporter abuse_ch
Tags:iso RemcosRAT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: rcloud01.siamdataidc.com
Sending IP: 43.229.149.15
From: Polat Furkan <elbi@elbipharma.com>
Subject: Blood pressure monitors, gauges, cuffs, Medical defibrillators, aneroids, or infusors samples and quotation #68639209
Attachment: samples and quotation 68639209.iso (contains "samples and quotation #68639209.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/75b21b5404153ab244a1d1f54565464866dab7ca53059b3a3d2abd5dab2953b4/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=owzbwvaecu5lerfb2h2ukzkgjbtnvn6kkmczwor5fk6v3kzjko2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/75b21b5404153ab244a1d1f54565464866dab7ca53059b3a3d2abd5dab2953b4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso 75b21b5404153ab244a1d1f54565464866dab7ca53059b3a3d2abd5dab2953b4

(this sample)

RemcosRAT

Executable exe 96359e31d13a327a3d1de808c5420193be3691628da4f409d8d5ed14be35b038

  
Dropping
MD5 0cdc5d6d8860d5c185c7fee43b17c702
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 96359e31d13a327a3d1de808c5420193be3691628da4f409d8d5ed14be35b038

Comments