MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a3ad9accd5a90ff0b315720cc84d2703397793d7a1957f6bf9f5d911bcb2e337. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a3ad9accd5a90ff0b315720cc84d2703397793d7a1957f6bf9f5d911bcb2e337
SHA3-384 hash: 39c85346e6ecabb02adcd14e70ce0a34644cf94f48238461bb341e70f67a86e8ac0ad0e5a6b86cc83a219bfb37348a21
SHA1 hash: 590589cab9c5f3a021276a80570eb1440c2fc104
MD5 hash: 0fc0b704b14e9e5c04c71b2f768740f3
humanhash: tennessee-lima-colorado-california
File name:Attachment.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'441'792 bytes
First seen:2021-04-04 08:23:54 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:kL9xpvuy0SLIzpK8UflZVcFWwOfCFETO2XiL4Uj3:y9xQRsIzuPBC+TOu
TLSH 7265AE21E3C14073E1632F345C6EB6B55826BF622DE8A54977E81D485F3B782393D28B
Reporter abuse_ch
Tags:DHL iso RemcosRAT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.checkddelivery.com
Sending IP: 209.145.54.67
From: Dhl Customer Support <mail@checkddelivery.com>
Subject: Delivery Failed
Attachment: Attachment.iso (contains "Document.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
356
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs1729.UNOFFICIAL
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
MALICIOUS
Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-04-04 10:36:09 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uowzvtgvveh7bmyvoigmqtjham4xpe6xugkx627z6xmrdpfs4m3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso a3ad9accd5a90ff0b315720cc84d2703397793d7a1957f6bf9f5d911bcb2e337

(this sample)

RemcosRAT

Executable exe 896d2dc1eab72419ab524333d3fba88c8ddf92b087f1c9af5d6ea402b0c77d89

  
Dropping
MD5 26382b4f3cc97798992f8c88c27febdd
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 896d2dc1eab72419ab524333d3fba88c8ddf92b087f1c9af5d6ea402b0c77d89

Comments