MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bef59c29d0ff3f0b51ee6658468339c8070ab9486a9960192a33971a2e7acd4d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bef59c29d0ff3f0b51ee6658468339c8070ab9486a9960192a33971a2e7acd4d
SHA3-384 hash: c02fea5ffdea3f24efcfb082b1a5cc63f320db0918e486da99acf6399bed313ce4c08f3a1cb66739d0fabbc1e2324f6f
SHA1 hash: ca60eafef88995b6adfca7d2c785deddab4b4e3f
MD5 hash: 4c8a843f191fcd66240818d9870d2f49
humanhash: uncle-quebec-lamp-equal
File name:DHL Detail.img
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'245'184 bytes
First seen:2020-12-07 16:30:37 UTC
Last seen:2020-12-07 20:35:41 UTC
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:q1Iw9cjTPAxym4Xi01X/bpxH0cFxQesmo1nQlJoF:q1Ir304v1XzpxVo16
TLSH B7456D5F0A1C6351E401BB704D883D04AE9C6DD08B30BDCAE6A4A5E9B9F93E8F5CF255
Reporter cocaman
Tags:img RemcosRAT


Avatar
cocaman
Malicious email (T1566.001)
From: "DHL Customer Service <customer@dhi.com>" (likely spoofed)
Received: "from peaceful-spence.52-175-64-117.plesk.page (unknown [52.175.64.117]) "
Date: "Mon, 07 Dec 2020 16:11:39 +0000"
Subject: "DHL - Pending delivery"
Attachment: "DHL Detail.img"

Intelligence

File Origin
# of uploads :
2
# of downloads :
156
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs2060.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bef59c29d0ff3f0b51ee6658468339c8070ab9486a9960192a33971a2e7acd4d/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=x32zykoq747qwupomzmenazzzadqvokinkmwagjkgolrult2zvgq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bef59c29d0ff3f0b51ee6658468339c8070ab9486a9960192a33971a2e7acd4d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

img bef59c29d0ff3f0b51ee6658468339c8070ab9486a9960192a33971a2e7acd4d

(this sample)

RemcosRAT

Executable exe 849c170a469dc6f5b1bc190923744b08c51ea0ea593e435f0121b874af58c3ec

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 849c170a469dc6f5b1bc190923744b08c51ea0ea593e435f0121b874af58c3ec
  
Dropping
RemcosRAT

Comments