MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f19cdd09fd443703d9cf267b2c5af8434cad4b351cbc6083e109f34a0c256983. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f19cdd09fd443703d9cf267b2c5af8434cad4b351cbc6083e109f34a0c256983
SHA3-384 hash: ce6a57c748319127ed3b2640ac737a12ca43907a569580a847378ccb26bdd398002b9343343a27e63de44e8876e2d8ec
SHA1 hash: 1a9ae9a7b38d275f2c893b209fff318f2dc46a0b
MD5 hash: decf39467f2aca42a9df94b0a7b78cce
humanhash: don-massachusetts-tennis-montana
File name:Attachment.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'507'328 bytes
First seen:2022-04-16 19:58:54 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:/lQI+DaXFl8aTz6ruQfM+CIj3BYAB58mwP3CXnJnXnG8VCNsFKzaRHr:9nFlDH6dfM+CIdzB58r0JnXnG1xz
TLSH T12C659E23B2904433D1671F788D6B5798682ABE113E29AD463BF4FE0C5F392C17939297
TrID 99.4% (.NULL) null bytes (2048000/1)
0.2% (.ISO) ISO 9660 CD image (5100/59/2)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
Reporter cocaman
Tags:DHL iso


Avatar
cocaman
Malicious email (T1566.001)
From: "mail@senderdl.com" (likely spoofed)
Received: "from senderdl.com (senderdl.com [23.254.166.149]) "
Date: "Fri, 15 Apr 2022 07:41:25 -0700"
Subject: "DHL: Delivery Status Update"
Attachment: "Attachment.iso"

Intelligence

File Origin
# of uploads :
1
# of downloads :
514
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs1729.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Downloader-FCIV038C156EB3A7.17740.1397.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control.exe keylogger remote.exe replace.exe
Link:
https://www.filescan.io/uploads/625b2006482f2f41cabe8565/reports/3c1afb47-2290-4cfd-babc-061b004cb2f3/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f19cdd09fd443703d9cf267b2c5af8434cad4b351cbc6083e109f34a0c256983/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-04-15 14:36:23 UTC
File Type:
Binary (Archive)
Extracted files:
72
AV detection:
18 of 42 (42.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6gon2cp5iq3qhwopez5sywxyingk2szvds6gba7bbhzuudbfngbq._file
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:modiloader family:remcos botnet:remotehost persistence rat trojan
Link:
https://tria.ge/reports/220416-yqdjmsgagn/
Behaviour
Modifies system certificate store
Runs net.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Adds Run key to start application
ModiLoader, DBatLoader
Remcos
Malware Config
C2 Extraction:
harveyautos110.ddns.net:2404
harveyautos111.hopto.org:2404
harveyautos112.ddns.net:2404
harvey205.camdvr.org:2404
harvey206.casacam.net:2404
harvey207.accesscam.org:2404
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f19cdd09fd443703d9cf267b2c5af8434cad4b351cbc6083e109f34a0c256983

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso f19cdd09fd443703d9cf267b2c5af8434cad4b351cbc6083e109f34a0c256983

(this sample)

RemcosRAT

Executable exe 9c9243f11dd44d1f1ac97716014be57244dca97a514e73d5f13da03392cba358

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9c9243f11dd44d1f1ac97716014be57244dca97a514e73d5f13da03392cba358

Comments