MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b375f9e9da2dbdf859d566547a229f32462daee0e5cebe296ed8e1ec17ae2fdd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b375f9e9da2dbdf859d566547a229f32462daee0e5cebe296ed8e1ec17ae2fdd
SHA3-384 hash: ad8233cbee2be15747aba76b9bdb3c8bab6fb441f5c9b863157e4ad753808e52c70f5c5ddd39570f077a951b4b408a72
SHA1 hash: 776c2929614b99a50fb98b2cc7b46ce39f5e33ca
MD5 hash: 1ff87c1679336a0c7f243dfa8497f0ac
humanhash: indigo-football-network-virginia
File name:Kreuzmayr_PO_22656_65564345565643ETD,pdf.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:978'944 bytes
First seen:2021-02-16 14:19:16 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:lOzzcxrBWwx/vdym2RHAxMGD5usGjghCoDaMycZ+HB:lUzQJ1Z2xzGDAsG0htDocGB
TLSH F325D4F2E95A8E31F05B143DE48EF6381826BCF1391C846A5EE87F09AAA375C3511477
Reporter abuse_ch
Tags:iso RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: cloudhost-2290780.us-midwest-1.nxcli.net
Sending IP: 8.36.41.54
From: Kreuzmayr Maschinenbau GmbH <office@kreuzmayr.com>
Subject: RE: PI22656 / Dringende
Attachment: Kreuzmayr_PO_22656_65564345565643ETD,pdf.iso (contains "Kreuzmayr_PO_22656_65564345565643ETD,pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
239
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_badexts72.UNOFFICIAL
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b375f9e9da2dbdf859d566547a229f32462daee0e5cebe296ed8e1ec17ae2fdd/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-02-16 14:20:10 UTC
AV detection:
15 of 46 (32.61%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wn27t2o2fw67qwovmzkhuiu7gjdc3lxa4xhl4klo3dq6yf5of7oq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b375f9e9da2dbdf859d566547a229f32462daee0e5cebe296ed8e1ec17ae2fdd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso b375f9e9da2dbdf859d566547a229f32462daee0e5cebe296ed8e1ec17ae2fdd

(this sample)

RemcosRAT

Executable exe de207ca43d42f8ec2066469bb68012d54652bd20369880c239aca6fb7f5ca0dd

  
Dropping
MD5 22e1ade85eaa131db812554fcc734a7b
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 de207ca43d42f8ec2066469bb68012d54652bd20369880c239aca6fb7f5ca0dd

Comments