MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a2332a97845710ed0499bd4bb47bd20f8eca3af94a40f126e14ce3228f4fa09a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a2332a97845710ed0499bd4bb47bd20f8eca3af94a40f126e14ce3228f4fa09a
SHA3-384 hash: 7b7b61ab1e674837025a46cd534f315d3d8e587115073794dfd179ec5485fecddbf8bad4eb59f80783c78f499427b736
SHA1 hash: bef5e453014e7ad9767f8138b881483216c146b2
MD5 hash: 7474e138e62b4f6fcad95ade0bd2c267
humanhash: alanine-lima-harry-music
File name:Fedex Detail.img
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'245'184 bytes
First seen:2020-12-03 17:47:17 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:Xo/3PYXMYkLIAoeKdtEWol+zQ+riS16f:XotYdeKgCzQ+2q
TLSH C045E00672808872D86417301472DE70577BBF727F36B69B778C372E5BB32E2546628A
Reporter abuse_ch
Tags:img nVpn RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: smtp5
Sending IP: 52.147.163.251
From: FedEX | Express Delivery <shippment@fedex.comm>
Subject: Shipping Arrival Notice
Attachment: Fedex Detail.img (contains "ups file.exe")

RemcosRAT C2s:
u875414.nsupdate.info
u875414.nvpn.to
u875414.ddns.net
u875414.duckdns.org

Intelligence

File Origin
# of uploads :
1
# of downloads :
196
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a2332a97845710ed0499bd4bb47bd20f8eca3af94a40f126e14ce3228f4fa09a/
Threat name:
Win32.Trojan.RemcosRAT
Create hunting rule
Status:
Malicious
First seen:
2020-12-03 17:48:06 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uizsvf4ek4io2bezxvf3i66sb6hmuoxzjjapcjxbjtrsfd2pucna._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a2332a97845710ed0499bd4bb47bd20f8eca3af94a40f126e14ce3228f4fa09a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

img a2332a97845710ed0499bd4bb47bd20f8eca3af94a40f126e14ce3228f4fa09a

(this sample)

RemcosRAT

Executable exe b704ceb41947acea7cb7c2d1a5b3de33b25120728fec16b4d8b35fbaa05e5afb

  
Dropping
MD5 d14601bd941b6e2f26252e66c67d1869
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b704ceb41947acea7cb7c2d1a5b3de33b25120728fec16b4d8b35fbaa05e5afb

Comments