MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 80c4314ef4834ab9ea84c51934649c57ba98d331b08503081fbb35c5721cc378. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 80c4314ef4834ab9ea84c51934649c57ba98d331b08503081fbb35c5721cc378
SHA3-384 hash: 650cd05dafacedd563c57cabf5ab11984281b993f3ed6d59353e8aef48114cb0c07d9c6efabfc8d5f21dbd6d79aa32b0
SHA1 hash: c37bd17cf37ddec821227491023bb05901d7cc49
MD5 hash: 70bf77982e30fef42fd6556cfa5dc696
humanhash: salami-cold-zebra-maine
File name:dhl.img
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'572'864 bytes
First seen:2020-05-20 11:20:01 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:TKTBS07b0q/bC23zgs4tYj+R64TXpONR08:TKY+e23MsIoZ4wRX
TLSH 59757E22F2919433C223297CDD1B97A4AC2ABE513E546C467BEC5D4C9F3E392343A197
Reporter abuse_ch
Tags:DHL img nVpn RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: xray-sector
Sending IP: 103.1.185.133
From: DHL <support@dhl.com>
Subject: Dear Customer
Attachment: dhl.img (contains "DHL.exe")

RemcosRAT C2s:
u863495.awsmppl.com:2404 (91.193.75.81)
lakeside007.awsmppl.com

Pointing to nVpn:

% Information related to '91.193.75.0 - 91.193.75.255'

% Abuse contact for '91.193.75.0 - 91.193.75.255' is 'abuse@kgb-vpn.org'

inetnum: 91.193.75.0 - 91.193.75.255
netname: NON-LOGGING-VPN-SERVICE
descr: Please note that we don't store any user data.
descr: Our main effort is not to make money, but to preserve values like the
descr: freedom of expression, the freedom of press, the right to data protection
descr: and informational self-determination.
descr: We ask all employees of Spamhaus and all self-proclaimed deputy sheriffs
descr: to stop your attacks against us.
country: EU
admin-c: KA7109-RIPE
tech-c: KA7109-RIPE
org: ORG-KHd1-RIPE
status: ASSIGNED PI
mnt-by: RIPE-NCC-END-MNT
mnt-by: KGB-MNT
mnt-routes: KGB-MNT
sponsoring-org: ORG-MW1-RIPE
created: 2012-06-04T11:05:55Z
last-modified: 2019-12-05T05:39:00Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-20 11:35:35 UTC
File Type:
Binary (Archive)
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qdcdctxuqnflt2ueyumtize4k65jruzrwccqgca7xm24k4q4yn4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

img 80c4314ef4834ab9ea84c51934649c57ba98d331b08503081fbb35c5721cc378

(this sample)

RemcosRAT

Executable exe 9dbdec587ca0c7713c3b5bb6e95803937226529b3b4515df219a8860cecfe76d

  
Dropping
MD5 ca2515407da5152297aef4e50a789d58
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9dbdec587ca0c7713c3b5bb6e95803937226529b3b4515df219a8860cecfe76d

Comments