MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fc2cd7af625a34d4db1f8d60b07dc5f0577c5859ca9ec64fef7e5f27b207783b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fc2cd7af625a34d4db1f8d60b07dc5f0577c5859ca9ec64fef7e5f27b207783b
SHA3-384 hash: 790754f55d2eda17ecf45ece15ec212f6c358a431027fc72b9bdf523835bba8f97b3e7296727cb30c0d43bc6b7fc359c
SHA1 hash: c9a02beeeff268694286e6de6a52157154e058b6
MD5 hash: 4abd1045e78be060ac6b5ef274bc668e
humanhash: kentucky-speaker-winter-carbon
File name:DL7593462,Shipment Document,pdf.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:581'632 bytes
First seen:2020-10-26 10:16:35 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:o08ADHmunZIgJkfgUj7r+mh9kbnzPxZ+b7QO9C:jDHYYwrhkTj3DO
TLSH 6EC4C02272889741E53987F95412D03067F6BC86DB32D6193DEC7ADF37B2E858B26702
Reporter abuse_ch
Tags:DHL iso RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: vps.dureamprad.com
Sending IP: 45.95.170.139
From: DHL Express Cargo <delivery@dhl.com>
Subject: RV: DHL CARGO DELIVERY
Attachment: DL7593462,Shipment Document,pdf.iso (contains "DL7593462,Shipment Document,pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.424.19070.18057.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fc2cd7af625a34d4db1f8d60b07dc5f0577c5859ca9ec64fef7e5f27b207783b/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-25 21:43:19 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7qwnpl3cli2njwy7rvqla7of6blxywczzkpmmt7ppzpspmqhpa5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso fc2cd7af625a34d4db1f8d60b07dc5f0577c5859ca9ec64fef7e5f27b207783b

(this sample)

RemcosRAT

Executable exe 586e6d87926659657100318f4efc9407706ceb71106b4d97757c30d100168d41

  
Dropping
MD5 413978821e2051205e7d01f03b3d4e2f
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 586e6d87926659657100318f4efc9407706ceb71106b4d97757c30d100168d41

Comments