MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a6d8ed9921a12981440e39514a980c2e7a255b4aa284692d8fdc5aa967921857. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a6d8ed9921a12981440e39514a980c2e7a255b4aa284692d8fdc5aa967921857
SHA3-384 hash: cdef91a35e290ab80b488630bc79365bab44918db25266c264b51921bb65073753d1c7c9689762b2524c6fb84139d2b9
SHA1 hash: 5e32fb38d5ca3541866c534be0e686990fd46ea8
MD5 hash: d525cd7939631f2a6314e9db20553b39
humanhash: carpet-spring-connecticut-bravo
File name:PO CBV87654468,pdf.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:700'416 bytes
First seen:2020-10-28 06:51:47 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:bsfFALfts57lgXPB0TyvqKd4ZpIUMpYjOKS8Uy1:L
TLSH E2E4963D6E8826A3E177E276A0F50587FAE8658673780C4B11C73B486D5AF023E9734D
Reporter abuse_ch
Tags:iso RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: s7.itlinkonline.com
Sending IP: 95.217.94.198
From: Nelly Juarez Reyes <njuarez@ridgid.com.mx>
Subject: RE: Order PO CBV87654468
Attachment: PO CBV87654468,pdf.iso (contains "PO CBV87654468,pdf.exe")

RemcosRAT C2:
insidelife1.ddns.net:8811 (216.38.7.231)

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Trojan.Generic-6629274-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a6d8ed9921a12981440e39514a980c2e7a255b4aa284692d8fdc5aa967921857/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-27 18:15:40 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=u3mo3gjbueuycraohfiuvgamfz5ckw2kukcgslmp3rnksz4sdblq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/a6d8ed9921a12981440e39514a980c2e7a255b4aa284692d8fdc5aa967921857

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso a6d8ed9921a12981440e39514a980c2e7a255b4aa284692d8fdc5aa967921857

(this sample)

RemcosRAT

Executable exe e26c95b32b64e3f7b5d72d52be2fd7cb52c7a2c1df25f5337a783a1735f806ad

  
Dropping
MD5 c640fc3549cca10fe0cb0eb046d83521
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e26c95b32b64e3f7b5d72d52be2fd7cb52c7a2c1df25f5337a783a1735f806ad

Comments