MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 90ed229bdbf47e97b3b17d90d94e0ba81b2b2dc16e54826c78029c6d34106ed4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 90ed229bdbf47e97b3b17d90d94e0ba81b2b2dc16e54826c78029c6d34106ed4
SHA3-384 hash: 7c27b699a67c5a2d0908a90260fabf33be54e2303834accfdca7402b887baf3a617d6c97dd97044b358a1ac69cf2ef56
SHA1 hash: e542f01b0d32501d4a8863997f71500b24ea58af
MD5 hash: 7822c5c0b784ba5959c49a77ff17b36d
humanhash: alanine-tennessee-arizona-beryllium
File name:DHL Details.img
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'245'184 bytes
First seen:2020-12-08 15:03:06 UTC
Last seen:2020-12-08 16:09:28 UTC
File type: img
MIME type:application/x-iso9660-image
ssdeep 3072:L9kIW0dpyHSudbi1J0WOy7xuBvdAUfZ66HpZ3PnVX/p5qWLcG598eVaqCNvJl7Yp:SIPyHS0i1J0ZOuBVAUI6HTnhhmk9ZC5
TLSH AB4549842D40C8ADD150CFF228F182B3D72E6FED6E24985E3618FF7A1B741AD1761A16
Reporter cocaman
Tags:img RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
109
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs1856.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.KillProc2.14899.16646.12275.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/90ed229bdbf47e97b3b17d90d94e0ba81b2b2dc16e54826c78029c6d34106ed4/
Threat name:
Win32.Backdoor.Rescoms
Create hunting rule
Status:
Malicious
First seen:
2020-12-08 13:13:15 UTC
File Type:
Binary (Archive)
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sdwsfg636r7jpm5rpwinstqlvanswlobnzkie3dyakog2naqn3ka._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Zbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/90ed229bdbf47e97b3b17d90d94e0ba81b2b2dc16e54826c78029c6d34106ed4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

img 90ed229bdbf47e97b3b17d90d94e0ba81b2b2dc16e54826c78029c6d34106ed4

(this sample)

RemcosRAT

Executable exe b5734fe9e898335433674437790e741440b75c6a749ceb7455555c88303daedc

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b5734fe9e898335433674437790e741440b75c6a749ceb7455555c88303daedc
  
Dropping
RemcosRAT

Comments