MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9c0332094f3ac7dbcc8d12629444520a75248b52d86a3b86241728a47aad3fc4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9c0332094f3ac7dbcc8d12629444520a75248b52d86a3b86241728a47aad3fc4
SHA3-384 hash: 75db6d08eb025297376156e6ea616e8f0d5e7b42d69c3ebabed436e543bdebd3627aaa25181d9cac71608bfd4eaec5a8
SHA1 hash: 17e917be5de87ad9a469fc20341573bf26d7aa8d
MD5 hash: 66ebf5d9a776466d2c000383b1c6bdd9
humanhash: sodium-river-may-moon
File name:Attachment.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'507'328 bytes
First seen:2021-11-08 07:05:53 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:6vY8dhGipM4Yld9SyATMUCAyo5qTThHokUflI+5MWBnsQfnEPV:u9b3O4YldFATMUR5eIv5PBlfK
TLSH T157656C19AE8805F3F26217347C5B57B9ED257E202A2DA4452EF53A4B5EF32903730C9B
Reporter cocaman
Tags:DHL iso RemcosRAT


Avatar
cocaman
Malicious email (T1566.001)
From: "Dhl Customer Support <info@teachmebaby.org>" (likely spoofed)
Received: "from postfix-inbound-6.inbound.mailchannels.net (inbound-egress-6.mailchannels.net [199.10.31.238]) "
Date: "Sun, 07 Nov 2021 13:31:21 -0800"
Subject: "Delivery Failed"
Attachment: "Attachment.iso"

Intelligence

File Origin
# of uploads :
1
# of downloads :
119
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs1729.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
fareit keylogger remcos
Link:
https://www.filescan.io/uploads/6188cc5d43a4f7480912f95b/reports/60447d71-01df-42c2-9854-f7dc0e9e226f/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9c0332094f3ac7dbcc8d12629444520a75248b52d86a3b86241728a47aad3fc4/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-11-05 15:56:14 UTC
AV detection:
22 of 44 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tqbteckphld5xtencjrjircsbj2sjc2s3bvdxbrec4uki6vnh7ca._file
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost persistence rat
Link:
https://tria.ge/reports/211108-hw4d9agfdp/
Behaviour
Modifies registry key
Suspicious use of WriteProcessMemory
Adds Run key to start application
Remcos
Malware Config
C2 Extraction:
salford1.ddns.net:2404
salford2.ddns.net:2404
salford3.ddns.net:2404
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9c0332094f3ac7dbcc8d12629444520a75248b52d86a3b86241728a47aad3fc4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso 9c0332094f3ac7dbcc8d12629444520a75248b52d86a3b86241728a47aad3fc4

(this sample)

RemcosRAT

Executable exe 85ba079f07da66a80dee82f93da2a0cd002d1cbd00bd285011288b04340a8d52

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 85ba079f07da66a80dee82f93da2a0cd002d1cbd00bd285011288b04340a8d52
  
Dropping
RemcosRAT

Comments