MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8f82df6564e2fc18b4928cc63c4948f16c4937d5c7db7e93401d7332f84f4cca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8f82df6564e2fc18b4928cc63c4948f16c4937d5c7db7e93401d7332f84f4cca
SHA3-384 hash: b0a1de0b4bbcd059ed0c5a1d729e7b81a23a6c4baf693a3bce2e5b482ec15d512969375bd6ede87ffa4e7f83e5657c71
SHA1 hash: 85cf63fb81edd3e65840a6a9d875f1ec1c6eb1e8
MD5 hash: e6a1481e656117b940d6d96cddecafd4
humanhash: stream-nuts-early-crazy
File name:RFQ 200629 Kloepfel.img
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'507'328 bytes
First seen:2020-06-29 12:01:44 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:VmXqeinhqmSqxnDqnsQi8oMr8gRZAMrK+g7xBpCIJuxd6Ur5IScz5ISF+gAuA1Kp:VoAjSqxusBdq7rkqYX/ebPx+E7uoD
TLSH 3B65AE22F3D01037DD7326B89D5FAA6959267E802E69A84A2BF43DCA5F3D3517C1D083
Reporter abuse_ch
Tags:img RemcosRAT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: cloudhost-433832.uk-south-2.nxcli.net
Sending IP: 165.84.219.136
From: Lucas Jansen <info@kloepfel-consulting.com>
Subject: RFQ 200629 Kloepfel
Attachment: RFQ 200629 Kloepfel.img (contains "RFQ 200629 Kloepfel.scr")

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8f82df6564e2fc18b4928cc63c4948f16c4937d5c7db7e93401d7332f84f4cca/
Threat name:
Win32.Infostealer.BestaFera
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 12:03:10 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=r6bn6zle4l6brnesrtddyski6fwesn6vy7nx5e2advztf6cpjtfa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

img 8f82df6564e2fc18b4928cc63c4948f16c4937d5c7db7e93401d7332f84f4cca

(this sample)

RemcosRAT

Executable exe b176484826085c80e9872b953487b4eec786a7d13d971f9e4360de16e35ce8b4

  
Dropping
MD5 29a98efd16ded656e94d039702c8be66
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b176484826085c80e9872b953487b4eec786a7d13d971f9e4360de16e35ce8b4

Comments