MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c64026f3a75aae0061c011ea31523f423a1357697b60aad31b327feabacdfff3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c64026f3a75aae0061c011ea31523f423a1357697b60aad31b327feabacdfff3
SHA3-384 hash: e38e76d2a8ccc155d2bb8b259c22b39a497941c06a2b6194fac9cdb3994c75329754ae4ea32d44b90e12ba6c7c52f2d1
SHA1 hash: a8c15ee46d8b1dee2255261768d7466407f50b59
MD5 hash: 277c7deba0693a38c2ee49786b340e12
humanhash: ack-fillet-lake-sink
File name:ORDER_73537.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'277'952 bytes
First seen:2021-02-11 13:06:39 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:/EQ1uIWzkt466R0mX+kXU9JOdEtO5ETOf9QX:/xXt46gOkXggm0HFm
TLSH 4245D4F2BD0E8DA2F01B257EC84BD67804667C89790C405AAFE5BB4BDAB3304715917B
Reporter abuse_ch
Tags:iso RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: server.doole.io
Sending IP: 188.40.83.134
From: Gregor Zidan <akripol@akripol.si>
Subject: RE: REVISED Order 11/02/2021
Attachment: ORDER_73537.iso (contains "ORDER_73537.exe")

RemcosRAT C2:
marstonstyl247.ddns.net

Intelligence

File Origin
# of uploads :
1
# of downloads :
190
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BScope.TrojanDropper.Dapato.18694.UNOFFICIAL
Create hunting rule

Result
Verdict:
SUSPICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c64026f3a75aae0061c011ea31523f423a1357697b60aad31b327feabacdfff3/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-02-11 16:15:11 UTC
AV detection:
12 of 47 (25.53%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yzacn45hlkxaayoachvdcur7ii5bgv3jpnqkvuy3gj76vown77zq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Backdoor
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c64026f3a75aae0061c011ea31523f423a1357697b60aad31b327feabacdfff3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso c64026f3a75aae0061c011ea31523f423a1357697b60aad31b327feabacdfff3

(this sample)

RemcosRAT

Executable exe 20fe5347a7254b7f5d75c7fce2542b88abdb8d1939afe621544c61d35e45bdee

  
Dropping
MD5 06a71959adabc1b660732bdbb67376bd
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 20fe5347a7254b7f5d75c7fce2542b88abdb8d1939afe621544c61d35e45bdee

Comments