MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e129a5b26c193726c2347fd1718a71502b068359d2b9dce15413dfa79d2c28be. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e129a5b26c193726c2347fd1718a71502b068359d2b9dce15413dfa79d2c28be
SHA3-384 hash: 09f117503b758f496efdfab1ee7d8d1af424a6a6b88f2f8f889efde03f270e30828e29edeea300cc2523501805f593a1
SHA1 hash: c724b856e549937f7b566b89e583d90a46a0cbd0
MD5 hash: a1302890613444c9dd7d167125d21490
humanhash: robin-mango-october-blue
File name:Offer Request 6100003768.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:966'656 bytes
First seen:2021-02-22 07:09:53 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:GYUkRHVFnyXv1qhqV7ANT8QNE1C5h7bmhN:GY9b0Uhqnh
TLSH A72560B19B4A4F12F05B143DCD4AE6FA0712BC01372B99B61ED8F7478AA6781B9D0077
Reporter abuse_ch
Tags:iso RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: vmmail02.ridsa.com.ar
Sending IP: 190.103.224.9
From: Farizal Marlias <direct@my.ibm.com>
Subject: Offer Request 6100003768
Attachment: Offer Request 6100003768.iso (contains "Offer Request 6100003768.exe")

RemcosRAT C2:
marstonstyl247.ddns.net:3234

Intelligence

File Origin
# of uploads :
1
# of downloads :
244
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e129a5b26c193726c2347fd1718a71502b068359d2b9dce15413dfa79d2c28be/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-02-22 06:21:34 UTC
AV detection:
10 of 47 (21.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4eu2lmtmde3snqrup7ixdctrkavqna2z2k45zykucpp2phjmfc7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso e129a5b26c193726c2347fd1718a71502b068359d2b9dce15413dfa79d2c28be

(this sample)

RemcosRAT

Executable exe 22ac80592400a2e2ed64392413d1bc5ecbbb09f10a811d3243c7212252f75a2c

  
Dropping
MD5 cb4a9e8af1f4176a50ce0fec01c61f1c
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 22ac80592400a2e2ed64392413d1bc5ecbbb09f10a811d3243c7212252f75a2c

Comments