MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e583b0accd900dbe7decb6936b19c2e9c7aeb7a82fa373dd18d0d4a6226d498. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 3

Intelligence 3 IOCs YARA File information Comments

SHA256 hash:	2e583b0accd900dbe7decb6936b19c2e9c7aeb7a82fa373dd18d0d4a6226d498
SHA3-384 hash:	7edee4a0f5030a8c87d53b399b725ee51c57531423aa09db804117a594bbf0f6841436b7bdbd87aef8653978f3a19ffe
SHA1 hash:	593474c1674df6729ca2eba5bb6b9a7702966bb6
MD5 hash:	9de72bc2d4020d1cfd8bc66aa2b5981a
humanhash:	michigan-pennsylvania-angel-beer
File name:	Shipping Document.zip
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	783'084 bytes
First seen:	2020-06-08 12:42:10 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	12288:7Pc46u/QJykc7+uIIuhsFXWnx9FsacT4oK8K+uJi3DuRZLEjcN3is0O:o9u/L7+JIcsFXM9FsacT4+8i3DuRtdiQ
TLSH	7AF4233AC4A93CFF9B285C55A59B27E72CBE0C09709D0625AF7C25000B95DADA448AF4
Reporter	abuse_ch
Tags:	DHL RAT RemcosRAT zip

abuse_ch

Malspam distributing RemcosRAT:

HELO: vps.signform-pl.me
Sending IP: 45.95.169.216
From: DHL Express logistics <eg.tracing@dhl.com>
Subject: Fwd: Re: FW: invoice and packing list
Attachment: Shipping Document.zip (contains "Shipping Document.exe")

RemcosRAT C2:
www.fiamim.com:2556 (185.19.85.175)

% Information related to '185.19.84.0 - 185.19.85.255'

% Abuse contact for '185.19.84.0 - 185.19.85.255' is 'abuse@datawire.ch'

inetnum: 185.19.84.0 - 185.19.85.255
netname: DATAWIRE-DATACENTERS
descr: CUSTOMERS ZG01
country: CH
admin-c: DA4314-RIPE
tech-c: DA4314-RIPE
status: ASSIGNED PA
mnt-by: DATAWIRE-NOC
created: 2013-09-23T14:18:55Z
last-modified: 2013-09-23T14:18:55Z
source: RIPE