MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8786a48e0c3d21a761efc72b3817d6b636e934128311bfaa4f3cb04adc43555. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b8786a48e0c3d21a761efc72b3817d6b636e934128311bfaa4f3cb04adc43555
SHA3-384 hash: 25aa5269fedd26bdc3e1d1d11b95f71064dda2e9ce0e9da1088ac47e6a55dbeb2df19577740226e239d70e2e4fb427eb
SHA1 hash: 8595af29c860115a2dc8b44d8c921bf16cd1bef4
MD5 hash: 153105c3513baee09b5a214df42813b6
humanhash: arkansas-seven-coffee-monkey
File name:Attachment.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'572'864 bytes
First seen:2021-02-20 07:54:25 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:VqLRve0noZ5a7yI5+bIBM+XzdQu3ECoDaMycZ+3:VU5ngpI5oXkgtDocS
TLSH CD757FF3990A4AE1F37B053CF48BE73414A7F8B3390956652E947B058A6AB58F430877
Reporter abuse_ch
Tags:DHL iso nVpn RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: mail.issuedelivery.online
Sending IP: 161.97.149.176
From: Dhl Customer Support <help@issuedelivery.online>
Subject: Order Delivery Failed
Attachment: Attachment.iso (contains "Attached file.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
267
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.Fareit-9832696-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b8786a48e0c3d21a761efc72b3817d6b636e934128311bfaa4f3cb04adc43555/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-02-20 07:55:08 UTC
AV detection:
20 of 47 (42.55%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xb4gushaypjbu5q67rzlhal5nnrw5e2bfayrx6ve6pfqjloegvkq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso b8786a48e0c3d21a761efc72b3817d6b636e934128311bfaa4f3cb04adc43555

(this sample)

RemcosRAT

Executable exe d79a8f491c0112c3f26572350336fe7d22674f5550f37894643eba980ae5bd32

  
Dropping
MD5 248b9f1f26b6a3270afd188ef293304b
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d79a8f491c0112c3f26572350336fe7d22674f5550f37894643eba980ae5bd32

Comments