MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ec0e32302557575a3df904dea70ad9f04bfe436cef1a880d18a5f256612d6064. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ec0e32302557575a3df904dea70ad9f04bfe436cef1a880d18a5f256612d6064
SHA3-384 hash: 5f2910473f9539c395d6b6e21e374aa554f78f1a6f186305d1ee897823ce9f0de198464a65fe48697c6935efc6fc907e
SHA1 hash: 7e309d606f5674fe76897c5a6e1f44cf3f706dce
MD5 hash: 5c55347428dc15ca68ebd279a2bdcd70
humanhash: november-nevada-vegan-fruit
File name:DHL_119040 documento de recibo,pdf.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:753'664 bytes
First seen:2020-10-25 17:15:53 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:q5GNYe6NHnnGv7lgXPB0TyvqKd4ZpIUMpYjOKS8:
TLSH 72F4D93C6E8425A3D173E276A0F90587FAE8698673785D4B12C37B482D6AF023D9734D
Reporter abuse_ch
Tags:DHL iso MailChannels RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: insect.birch.relay.mailchannels.net
Sending IP: 23.83.209.93
From: DHL Express Cargo <delivery@dhl.com>
Subject: RV: ENTREGA DE CARGA DHL
Attachment: DHL_119040 documento de recibo,pdf.iso (contains "DHL_119040 documento de recibo,pdf.exe")

RemcosRAT C2:
insidelife1.ddns.net:8811

Intelligence

File Origin
# of uploads :
1
# of downloads :
52
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Trojan.Generic-6629274-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ec0e32302557575a3df904dea70ad9f04bfe436cef1a880d18a5f256612d6064/
Threat name:
ByteCode-MSIL.Trojan.RemcosRAT
Create hunting rule
Status:
Malicious
First seen:
2020-10-25 16:02:49 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5qhdembfk5lvuppzatpkocwz6bf74q3m54niqdiyuxzfmyjnmbsa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ec0e32302557575a3df904dea70ad9f04bfe436cef1a880d18a5f256612d6064

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso ec0e32302557575a3df904dea70ad9f04bfe436cef1a880d18a5f256612d6064

(this sample)

RemcosRAT

Executable exe 786dd4d9050a7a8d83b60280da6360b73ebf5680da7c9e5d8f6762f425ba099e

  
Dropping
MD5 5608705449f9024fd604e2aa95ddf473
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 786dd4d9050a7a8d83b60280da6360b73ebf5680da7c9e5d8f6762f425ba099e

Comments