MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ead3469213b443100cd0d24ba132da279c8d10ccefab825ccaac89d6dd9fbef3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ead3469213b443100cd0d24ba132da279c8d10ccefab825ccaac89d6dd9fbef3
SHA3-384 hash: 0b77a77ab7b6a1672cf1f518af6fd24d799d466b2c5b00cc4169687e8911bcf1b10c71284616feb659fe403809c53c95
SHA1 hash: 8706200565617cdabba0c64e14a775ef69d36d9b
MD5 hash: e406aa5fd83a939f318be0a0653f0be6
humanhash: bluebird-comet-grey-early
File name:PEDIDO-6764,pdf.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:290'816 bytes
First seen:2020-11-26 06:40:25 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:HIT2hagq5pOkLww2rbJAzK6jfrBxNpBG5zwM8:oT2PpnyW6bfN5
TLSH 375401406B589073DDBA9D33B9C13752CB33B6232576C5AB354E4505EFA33C3994A3A8
Reporter abuse_ch
Tags:iso RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: learsoft.com.ar
Sending IP: 190.210.215.185
From: Angel vargas<angel.vargas@dopingmaq.com.mx>
Subject: NUEVA ORDEN DE COMPRA
Attachment: PEDIDO-6764,pdf.iso (contains "PEDIDO-6764,pdf.exe")

RemcosRAT C2:
uzbektourism8739.ddns.net

Intelligence

File Origin
# of uploads :
1
# of downloads :
108
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ead3469213b443100cd0d24ba132da279c8d10ccefab825ccaac89d6dd9fbef3/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-11-26 06:41:04 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5ljuneqtwrbradgq2jf2cmw2e6oi2egm56vyexgkvse5nxm7x3zq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso ead3469213b443100cd0d24ba132da279c8d10ccefab825ccaac89d6dd9fbef3

(this sample)

RemcosRAT

Executable exe d5349ef208ec6521c83f1eccc8cf74d0364076f2b0020938716f7974af1105aa

  
Dropping
MD5 3ef6e25f5aa09df5dd38e0f0abfdad02
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d5349ef208ec6521c83f1eccc8cf74d0364076f2b0020938716f7974af1105aa

Comments