MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 64e093993a25242c147a531b6562e4a44633af01d98385517b21f7ea369950cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 2

Intelligence 2 IOCs YARA File information Comments

SHA256 hash:	64e093993a25242c147a531b6562e4a44633af01d98385517b21f7ea369950cc
SHA3-384 hash:	c66d4b8e2c3fbb56b8b022fd4b20196accf9713bd693dde64813b287239f6e78b381d898c9accd215d5b50c426fe53c9
SHA1 hash:	8a171fc6ef3d45026410825db66443d9c47e52ce
MD5 hash:	f30e71824315f710e081ce71920f6296
humanhash:	network-idaho-golf-lactose
File name:	DHL 8897209547 Documento di ricezione, pdf.iso
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	391'168 bytes
First seen:	2020-06-25 09:04:22 UTC
Last seen:	Never
File type:	iso
MIME type:	application/x-iso9660-image
ssdeep	6144:G+w6PwvHFHS0YzAaqxCi0q7pWqmVEvynLdWgxq4g97G6+nFRAH9R:ZPPwfFHEzAL0sQqyEuHCq6E8
TLSH	4F84CF18035C8B99D6BD8B79D0E1200583F9A602615BEB697ECD70ED2FA37E1840B767
Reporter	abuse_ch
Tags:	DHL iso nVpn RAT RemcosRAT

abuse_ch

Malspam distributing RemcosRAT:

HELO: cloudhost-505135.us-midwest-1.nxcli.net
Sending IP: 209.87.159.221
From: DHL Express Cargo Italy <delivery@dhl.com>
Subject: Consegna merci DHL
Attachment: DHL 8897209547 Documento di ricezione, pdf.iso (contains "DHL 8897209547 Documento di ricezione, pdf.exe")

RemcosRAT C2:
egommbute2020.ddns.net:7171 (185.19.85.135)

Pointing to nVpn:

% Information related to '185.19.84.0 - 185.19.85.255'

% Abuse contact for '185.19.84.0 - 185.19.85.255' is 'abuse@datawire.ch'

inetnum: 185.19.84.0 - 185.19.85.255
netname: DATAWIRE-DATACENTERS
descr: CUSTOMERS ZG01
country: CH
admin-c: DA4314-RIPE
tech-c: DA4314-RIPE
status: ASSIGNED PA
mnt-by: DATAWIRE-NOC
created: 2013-09-23T14:18:55Z
last-modified: 2013-09-23T14:18:55Z
source: RIPE