MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eb0a00a601360aca8e5f211262247051f5741e75fecf2de11236dccd17c3ecaa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eb0a00a601360aca8e5f211262247051f5741e75fecf2de11236dccd17c3ecaa
SHA3-384 hash: 92466f0b7934e84e5f6fcde812b0f6fe6c6eb352d5a08d75df42804bbe0ffd15e6cca05647494fa89a009631f3963f66
SHA1 hash: f00c95a63610c3b3fb6c6e3e57098e4f0b06469e
MD5 hash: 105a613ec0a85ba328747cc814addad1
humanhash: pizza-maryland-blossom-oregon
File name:Attachment.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'441'792 bytes
First seen:2022-04-21 07:25:28 UTC
Last seen:2022-04-21 07:47:34 UTC
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:sak03Y2ci01sS32v0I24Vl5IDQfyjd6kR/MVw8gdhKzaRHrL:75IFz32vfLVl6DQ6jd/MnBz
TLSH T163658E16B3914036D1332E785C5F96B46926BE21EF29B9862EF8FC0C3F356E23419257
TrID 99.4% (.NULL) null bytes (2048000/1)
0.2% (.ISO) ISO 9660 CD image (5100/59/2)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
Reporter cocaman
Tags:iso RemcosRAT


Avatar
cocaman
Malicious email (T1566.001)
From: "taxrefund@mailingresponses.com" (likely spoofed)
Received: "from hwsrv-963208.hostwindsdns.com (hwsrv-963208.hostwindsdns.com [142.11.209.184]) "
Date: "Wed, 20 Apr 2022 08:45:34 -0600"
Subject: "IRS Correction letter"
Attachment: "Attachment.iso"

Intelligence

File Origin
# of uploads :
17
# of downloads :
151
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs1729.UNOFFICIAL
Create hunting rule

Win.Dropper.Formbook-9917440-0
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
formbook
Link:
https://www.filescan.io/uploads/6261070c482f2f41cadeb8bf/reports/770baf9a-3488-4617-ac38-485495b5d705/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eb0a00a601360aca8e5f211262247051f5741e75fecf2de11236dccd17c3ecaa/
Threat name:
Win32.Trojan.RemcosRAT
Create hunting rule
Status:
Malicious
First seen:
2022-04-21 03:54:38 UTC
File Type:
Binary (Archive)
Extracted files:
52
AV detection:
19 of 41 (46.34%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5mfabjqbgyfmvds7eejgejdqkh2xihtv73hs3yisg3om2f6d5sva._file
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:modiloader family:remcos botnet:test persistence rat trojan
Link:
https://tria.ge/reports/220421-h9h1gaaafk/
Behaviour
Runs net.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Adds Run key to start application
ModiLoader Second Stage
ModiLoader, DBatLoader
Remcos
Malware Config
C2 Extraction:
nuvez112.ddns.net:2404
nuvez111.ddns.net:2404
nuvez110.ddns.net:2404
nuvez111.casacam.net:2404
nuvez110.camdvr.org:2404
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/eb0a00a601360aca8e5f211262247051f5741e75fecf2de11236dccd17c3ecaa

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso eb0a00a601360aca8e5f211262247051f5741e75fecf2de11236dccd17c3ecaa

(this sample)

RemcosRAT

Executable exe cf80023d35bef226afa7cae9b91ae7128a9c52eb70a7428e5a019ef2ac0ceba0

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cf80023d35bef226afa7cae9b91ae7128a9c52eb70a7428e5a019ef2ac0ceba0
  
Dropping
RemcosRAT
  
Dropping
MD5 29590740dcea22eff7887452dc757d7a

Comments