MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 df2a605bdc1d3b7107267bcbae998b3ec1eba7c8ca2347286fa733b22c418397. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: df2a605bdc1d3b7107267bcbae998b3ec1eba7c8ca2347286fa733b22c418397
SHA3-384 hash: 9b11de51fc014d41946e206cab93920bd5bcded5aec382fd0d264d1ad23c4dc82aeee1315f4cfc091957054b9a6c42f1
SHA1 hash: 4aa5ae586b531958f6381332750b19a410b1d81e
MD5 hash: 5503a0a0d5516a99d571c0725e516faf
humanhash: finch-beer-seventeen-december
File name:Documento AWB DHL 3374687886.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:737'280 bytes
First seen:2021-01-14 20:07:28 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:4BO6i1M18b7zNgVxmzcZzmkjtLnhf/b9gS6Xr8wJPy:Ci1vbPN8xmgcqpBb9gSLn
TLSH 72F47C519BD19711D7BC23FE6005106127F6D37AF3E8E7A8EC4960B6AF9686801FD2C2
Reporter abuse_ch
Tags:DHL ESP geo iso RemcosRAT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail6.brandsloveki.com
Sending IP: 164.90.147.2
From: DHL Express<delivery@dhl.com>
Subject: RV: Aviso de envío DHL Express
Attachment: Documento AWB DHL 3374687886.iso (contains "Documento AWB DHL 3374687886.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
141
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs1729.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/df2a605bdc1d3b7107267bcbae998b3ec1eba7c8ca2347286fa733b22c418397/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=34vgaw64du5xcbzgppf25gmlh3a6xj6iziruokdpu4z3elcbqolq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/df2a605bdc1d3b7107267bcbae998b3ec1eba7c8ca2347286fa733b22c418397

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso df2a605bdc1d3b7107267bcbae998b3ec1eba7c8ca2347286fa733b22c418397

(this sample)

RemcosRAT

Executable exe db40b329c1ecea2045d4e2bc27fe712b52bbfc1d51ff1b55dcd3c8bb72258710

  
Dropping
MD5 e4e02951e1f41618256a13b0b682f74f
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 db40b329c1ecea2045d4e2bc27fe712b52bbfc1d51ff1b55dcd3c8bb72258710

Comments