MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a5b973cd98097f7aa43f842a75a7057f7a59dfb53ccd28e6d41d958ee7d8f15d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a5b973cd98097f7aa43f842a75a7057f7a59dfb53ccd28e6d41d958ee7d8f15d
SHA3-384 hash: 38d74a5bb1c4bdf1eb59f36ff85876561ef444db91dbd4bd08b58a598a2b8a0ec24575d1618ed49f3004027a96962857
SHA1 hash: 74bb4d4a01b3f1724fcaa3b289126eadb2fe2c48
MD5 hash: 64f5dc3f99e03ef248f0faf457fd6b8a
humanhash: early-nitrogen-lamp-failed
File name:PO AKG34947.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:964'608 bytes
First seen:2020-10-23 08:58:12 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:Hp2jyZEkrJ26/QsGYtPTv09CvJoM0pqgerR/pNH4s9FyuIX+:Hp2jyZEkrJ2h07cKJoZpE/TYs7yuIX+
TLSH 3E25BD02A3948F54F87E47385534D43057F6BC56A63AD2ACBDC538DF3EB3A818A05A27
Reporter abuse_ch
Tags:iso RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: llsa735-a17.servidoresdns.net
Sending IP: 82.223.190.26
From: Mikhailenko Elena Vladimirovna<jgenaro@pernoscorona.net>
Subject: RE: НОВЫЙ ПОРЯДОК (AKG)
Attachment: PO AKG34947.iso (contains "PO AKG34947.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Gen.NN.ZemsilF.34570.3m0@aWifWNc.10849.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a5b973cd98097f7aa43f842a75a7057f7a59dfb53ccd28e6d41d958ee7d8f15d/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-23 08:16:51 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uw4xhtmybf7xvjb7qqvhljyfp55ftx5vhtgsrzwudwky5z6y6foq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso a5b973cd98097f7aa43f842a75a7057f7a59dfb53ccd28e6d41d958ee7d8f15d

(this sample)

RemcosRAT

Executable exe c3c62460fce1e7c6964339da00bc229e02872c21de66a35c3aba8592ef7a8872

  
Dropping
MD5 78747fdda7bb19c68ec1db4d053bcdb4
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c3c62460fce1e7c6964339da00bc229e02872c21de66a35c3aba8592ef7a8872

Comments