MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce955f7e7ea6e3e9b24cfaace62b786cf54a2559869fd768f63170fdf0c4e303. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 7

Intelligence 7 IOCs YARA File information Comments

SHA256 hash:	ce955f7e7ea6e3e9b24cfaace62b786cf54a2559869fd768f63170fdf0c4e303
SHA3-384 hash:	19008ab72fbd24c32fd1f98363093fcf7499590b79540540bb7f4dfcd66e8ab61edde6803c4ca4dda7ac45b456dca585
SHA1 hash:	e315d82eec5c270aae50066f745024d1a5322764
MD5 hash:	f9a2562e69cf6904deaf82b06557b508
humanhash:	oscar-kilo-ink-north
File name:	Attachment.iso
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	1'572'864 bytes
First seen:	2021-10-12 15:51:52 UTC
Last seen:	Never
File type:	iso
MIME type:	application/x-iso9660-image
ssdeep	12288:dp+vmyY9beSkj77NADGFvGq+EOvLkOUvIVPJvC+0yRK2urqoXkGsdr64lprmi:dMO3g13Wih+kOzPJp/Fo9KrRpm
TLSH	T1B6759E2AFAF66476C6371AB57C5B931CAC35FE001468A5072DF96C0CDFB5781383628A
Reporter	cocaman
Tags:	DHL iso

cocaman

Malicious email (T1566.001)
From: "Dhl Support" <dhl@deliveryvestap.om>" (likely spoofed)
Received: "from peaceful-hofstadter.185-176-220-49.plesk.page (unknown [185.176.220.49]) "
Date: "Tue, 12 Oct 2021 08:47:57 -0700"
Subject: "Delivery Failed"
Attachment: "Attachment.iso"

Intelligence

File Origin

# of uploads :

# of downloads :

145

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.W32.AIDetect.malware2.4787.11988.UNOFFICIAL

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

keylogger

Link:

https://www.filescan.io/uploads/6165af241c2d58ba74035aca/reports/9b4496d2-9c91-4d72-86d3-e9d8cbb1f9aa/overview

Result

Verdict:

SUSPICIOUS

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ce955f7e7ea6e3e9b24cfaace62b786cf54a2559869fd768f63170fdf0c4e303/

Threat name:

Win32.Trojan.Woreflint

Status:

Malicious

First seen:

2021-10-12 15:52:06 UTC

AV detection:

9 of 28 (32.14%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=z2kv67t6u3r6tmsm7kwomk3ynt2uujkzq2p5o2hwgfyp34ge4mbq._file

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos botnet:remotehost persistence rat

Link:

https://tria.ge/reports/211012-ta25vacga3/

Behaviour

Suspicious use of WriteProcessMemory

Adds Run key to start application

Remcos

Malware Config

C2 Extraction:

freelife.hopto.org:2404
freelife1.hopto.org:2404
freelife2.hopto.org:2404
freelife01.hopto.org:2404
freelife3.hopto.org:2404
freelife4.hopto.org:2404
freelife5.hopto.org:2404

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.94

Link:

https://yomi.yoroi.company/submissions/ce955f7e7ea6e3e9b24cfaace62b786cf54a2559869fd768f63170fdf0c4e303