MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c1744c7d7b205cb361a1286867516eed959746da00535c8f5d9919da55e71c87. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c1744c7d7b205cb361a1286867516eed959746da00535c8f5d9919da55e71c87
SHA3-384 hash: 86fe0e25d2c7145486709e6f75989c07123ecb7c8e257652682b116e98f163619bfe7705ae9039fe2e73aa817d947f34
SHA1 hash: 2528ca83e19591a331224d74a0a92f2d23175a50
MD5 hash: e8843a3a4e768783e1932ea729a753e7
humanhash: december-double-california-cup
File name:Shipment Receipt.img
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'245'184 bytes
First seen:2021-01-12 18:08:03 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:OLSPZBcNImhXwXZtBG3er5G2Q8hGy+gJ6:HBlp7fGShAO
TLSH 7A45C5DE12F1105BD1184AB4A959BFE015A1ECB87B12C216BE44FCCEBF723E154622E3
Reporter abuse_ch
Tags:DHL img RemcosRAT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: secu118s.vixweb.net
Sending IP: 101.79.49.118
From: DHL EXPRESS <mitwalli@kmcholding.com>
Subject: Shipment Arrival Notification!!!
Attachment: Shipment Receipt.img (contains "Shipment Receipt.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
128
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.17822.12946.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c1744c7d7b205cb361a1286867516eed959746da00535c8f5d9919da55e71c87/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-01-12 15:44:51 UTC
AV detection:
10 of 46 (21.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yf2ey7l3ebolgynbfbugoulo5wkzorw2abjvzd25tem5uvphdsdq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.66
Link:
https://yomi.yoroi.company/submissions/c1744c7d7b205cb361a1286867516eed959746da00535c8f5d9919da55e71c87

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

img c1744c7d7b205cb361a1286867516eed959746da00535c8f5d9919da55e71c87

(this sample)

RemcosRAT

Executable exe bfe8692e2e6e89e7d77482f315a22b3679e511e50eab20ba852cabc06dc4e5fa

  
Dropping
MD5 119fe6c26920d66df7868c7d3dafa731
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bfe8692e2e6e89e7d77482f315a22b3679e511e50eab20ba852cabc06dc4e5fa

Comments