MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 81b553124f232620ac6211d238aa433e10326b8023c9ff36ac4a9e0e229a1e94. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 81b553124f232620ac6211d238aa433e10326b8023c9ff36ac4a9e0e229a1e94
SHA3-384 hash: a719d70fcd0338947e54cf24367839933725f4e28ffa304c71aa57e88ee3290c8d2eac4892bbf98cbcfe861043f71f2e
SHA1 hash: 397ce5e255c167f2b82b79ab47000f9399e94ef9
MD5 hash: f6402ab557688bf9d808682a52fdee56
humanhash: carbon-twelve-vegan-fillet
File name:Attachment.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'245'184 bytes
First seen:2022-03-22 17:07:44 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:e4hy7R3xhCSSDNCS1EFayb+TyIG6r3V9aGtvgDUYSF9Tc6mv4:27R333SDNCS1EFayAZIGow39Ov4
TLSH T12145E00536B89B22DABD83F81912D1409BF2792F6461E2097DCFA4EC6BF5F504981F1B
Reporter cocaman
Tags:DHL iso RemcosRAT


Avatar
cocaman
Malicious email (T1566.001)
From: "mail@deliverydll.com" (likely spoofed)
Received: "from deliverydll.com (deliverydll.com [23.254.165.29]) "
Date: "Tue, 22 Mar 2022 07:23:46 -0600"
Subject: "DHL On Demand Delivery"
Attachment: "Attachment.iso"

Intelligence

File Origin
# of uploads :
1
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs1729.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated packed update.exe
Link:
https://www.filescan.io/uploads/623a028fdfdfa8501ccda9d8/reports/dfee685e-5881-44b1-9bee-03f0503de565/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/81b553124f232620ac6211d238aa433e10326b8023c9ff36ac4a9e0e229a1e94/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-03-22 17:08:13 UTC
File Type:
Binary (Archive)
Extracted files:
20
AV detection:
11 of 26 (42.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qg2vgespemtcbldcchjdrksdhyide24aepe76nvmjkpa4iu2d2ka._file
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:covid collection rat spyware stealer
Link:
https://tria.ge/reports/220322-vnj2vsgda9/
Behaviour
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Reads user/profile data of web browsers
Downloads MZ/PE file
NirSoft MailPassView
NirSoft WebBrowserPassView
Nirsoft
Remcos
Malware Config
C2 Extraction:
harveyautos110.ddns.net:2404
harveyautos111.hopto.org:2404
harveyautos112.ddns.net:2404
harvey205.camdvr.org:2404
harvey206.casacam.net:2404
harvey207.accesscam.org:2404
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/81b553124f232620ac6211d238aa433e10326b8023c9ff36ac4a9e0e229a1e94

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso 81b553124f232620ac6211d238aa433e10326b8023c9ff36ac4a9e0e229a1e94

(this sample)

RemcosRAT

Executable exe ea812747173109ca7a8724a7a6a14b1518f436417a00e92d03b962d99821664c

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ea812747173109ca7a8724a7a6a14b1518f436417a00e92d03b962d99821664c

Comments