MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 da3b2e378021aafe35be703e52abaaca219af92a950cd183abf270d2943c5ebe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: da3b2e378021aafe35be703e52abaaca219af92a950cd183abf270d2943c5ebe
SHA3-384 hash: baaeb1c6801131e6aeb8fe31ea5e72234ab5bed567836d762c793f82b16ff268d781ded1685b3c7981ac69639e26efb8
SHA1 hash: ba4c0dbe68ab45e50f7b058b3ed1bf6a860685fa
MD5 hash: 81056f6ef60c980e9a83267d3b4d94ec
humanhash: august-helium-oklahoma-princess
File name:UPS Detail.img
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'507'328 bytes
First seen:2020-10-24 06:33:49 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:XmLs0OswD3pbZ/8cUpXA2ReVmb3sGYtPTPP9CySrqOaIhX4irIeNHVISkKX8+3jo:FlMA2QVS0LX9IXI2N8+3jnkE8
TLSH F665DF2612857F00F67E2B3BDAA49840A3FAFD016613DD2E6CE434CE56B1F51A907B17
Reporter abuse_ch
Tags:img RAT RemcosRAT UPS


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: grace
Sending IP: 52.143.119.158
From: UPS Customer Service <pkinfo@ups.com>
Subject: UPS - Package Arrival Notification
Attachment: UPS Detail.img (contains "6aoBH1azTKmchrm.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
111
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.34887160.22519.17212.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/da3b2e378021aafe35be703e52abaaca219af92a950cd183abf270d2943c5ebe/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2020-10-23 18:55:59 UTC
AV detection:
15 of 28 (53.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3i5s4n4aegvp4nn6oa7ffk5kziqzv6jksugnda5l6jynffb4l27a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/da3b2e378021aafe35be703e52abaaca219af92a950cd183abf270d2943c5ebe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

img da3b2e378021aafe35be703e52abaaca219af92a950cd183abf270d2943c5ebe

(this sample)

RemcosRAT

Executable exe a362c422dd9a2c24a7cc96dc14244742d24274b78da4b0a27157ac9e7c38b04a

  
Dropping
MD5 ba8a6e47aa879cca4370ee1d3aed79df
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a362c422dd9a2c24a7cc96dc14244742d24274b78da4b0a27157ac9e7c38b04a

Comments