MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3cb1f0bf9271783543bbeb0f5bfaa4e0d1d62e565e98d932e061d2a9618e15ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 3

Intelligence 3 IOCs YARA File information Comments

SHA256 hash:	3cb1f0bf9271783543bbeb0f5bfaa4e0d1d62e565e98d932e061d2a9618e15ab
SHA3-384 hash:	6b04b89c66a86f9fa6203b24df99ff8b047706a1fa5a2f723cd5b15526f851b3aa141a10d006bc5b3b3795619922ad08
SHA1 hash:	fb46ef544d06b7cbe032d285920628b840eeba2b
MD5 hash:	500fff478e031a7b5e59ab9be3f05ef6
humanhash:	juliet-wolfram-gee-papa
File name:	Attached pdf.zip
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	396'807 bytes
First seen:	2020-03-29 19:16:34 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	6144:ZVDGpUvcog6jm6NVPvPsvh27VlPJ0wToC3DueeA7AolkrRTMywGsbq6KW:mqFV3Py8vBHTquAolARTMnG8KW
TLSH	528423518D2E72654239A400A0B5DB97CD22BAD985FE21E8134178BC0CF8B61DFFDDB6
Reporter	abuse_ch
Tags:	COVID-19 GuLoader RemcosRAT zip

abuse_ch

COVID-19 themed malspam campaign dropping GuLoader->RemcosRAT:

iso->zip->exe

HELO: smmt
Sending IP: 52.162.94.61
From: irs gov <Help@irs.gov>
Subject: Covid-19 Emergency funds Update
Attachment: Attachment.iso (contains "Attached pdf.zip" -> "Attached pdf.exe")

GuLoader payload URL:
https://drive.google.com/u/0/uc?id=1bpSwXgeTfUQhGF7a4lwQmZroVPGuKeUO

RemcosRAT C2:
rex2015.freeddns.org:2404

Resolves to:
185.244.30.125

% Information related to '185.244.30.0 - 185.244.30.255'

% Abuse contact for '185.244.30.0 - 185.244.30.255' is 'abuse@FOS-VPN.org'

inetnum: 185.244.30.0 - 185.244.30.255
netname: Freedom_Of_Speech_VPN
remarks: Before you contact us, please read:
remarks: 185.244.30.0/24 belongs to a NON-LOGGING VPN service.
remarks: We don't log any user activities.
remarks: We believe that the right to informational self-determination and the
remarks: right to privacy are essential to all citizens of all countries.
remarks: We don't host anything else on our servers than VPN software and our
remarks: customers can open a fixed number of Ports.
remarks: Like Public WiFi or Tor Exit Node Operators we cannot be held responsible
remarks: for the actions of our customers, because we simply can't (and to be
remarks: honest: don't want) to control them.
remarks: For further information please read: http://www.torservers.net/abuse.html
country: EU