MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 792dc5561690f4811d6820f9277085fc74c4d8571cfa7b212bdb10972265fe2c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 792dc5561690f4811d6820f9277085fc74c4d8571cfa7b212bdb10972265fe2c
SHA3-384 hash: 392069742f55d31261f56b08e809ee468f1bd9f6f9cc134074ca56054c4010a790cd883a2d30a88abeb6223884b7397d
SHA1 hash: 5a26a9f34d8f46abacc989a2c9651310fe914afb
MD5 hash: 4c079880fc5f9eb8f13134a569b13980
humanhash: don-mango-march-twelve
File name:Offer Request Document,pdf.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:712'704 bytes
First seen:2020-08-19 06:54:55 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:um/ZNPa2c/PWwuUDKcoEwWLC2W2nKjdkOdqY55w/dPXjlBeh06sD:um/TyzPWwuUDpoEwECcKpkON/Uno0
TLSH B9E48E62E6804837C1531578AC0B5FE9D937AF103BA8AC477BEA2E0C5F397D17929097
Reporter abuse_ch
Tags:iso RemcosRAT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: rcloud01.siamdataidc.com
Sending IP: 43.229.149.15
From: info@td-bkh.ru
Subject: Offer Request 6100003768
Attachment: Offer Request Document,pdf.iso (contains "Offer & Request Document,pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/792dc5561690f4811d6820f9277085fc74c4d8571cfa7b212bdb10972265fe2c/
Threat name:
Win32.Trojan.Strictor
Create hunting rule
Status:
Malicious
First seen:
2020-08-19 06:56:11 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pew4kvqwsd2ichlied4so4ef7r2mjwcxdt5hwijl3mijoitf7ywa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/792dc5561690f4811d6820f9277085fc74c4d8571cfa7b212bdb10972265fe2c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso 792dc5561690f4811d6820f9277085fc74c4d8571cfa7b212bdb10972265fe2c

(this sample)

RemcosRAT

Executable exe f54187c724636062fdf6287ad5b83c5c198e44577158b30b15d1144c287f4c17

  
Dropping
MD5 4d3b3cbfc7fda510d8b98543745c74f1
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f54187c724636062fdf6287ad5b83c5c198e44577158b30b15d1144c287f4c17

Comments