MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 98f96cb05035be2a63ed8256535b40add7e8c3afc26e7bf8240f5f2125d02b3e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 2

Intelligence 2 IOCs YARA File information Comments

SHA256 hash:	98f96cb05035be2a63ed8256535b40add7e8c3afc26e7bf8240f5f2125d02b3e
SHA3-384 hash:	322e1a22029d4148d1387f5b610f0fac67234aa4c4bb2309e85f7843979947c32a7cd126d59d889bd1e5e8322d4afc29
SHA1 hash:	d43c15fbd10d2f7f632e382d9a87bc8eb22c3aec
MD5 hash:	164f3903da4ca58f01ee620f491947ec
humanhash:	four-salami-london-quebec
File name:	AETPL-TVOP6436556 P.O JUNE 250520.iso
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	665'600 bytes
First seen:	2020-05-25 08:32:00 UTC
Last seen:	Never
File type:	iso
MIME type:	application/x-iso9660-image
ssdeep	12288:jKVNyhTwLDwdCjaZE/D3yP37dug3pjuV:jCxLD0CjH/rkAg9S
TLSH	C8E46D62F290D87AE02701798C2B97385927FA152978085E3AED690C5F7B343747BF4B
Reporter	abuse_ch
Tags:	iso nVpn RAT RemcosRAT

abuse_ch

Malspam distributing RemcosRAT:

HELO: mx1.industri.ru
Sending IP: 213.135.75.146
From: Sabrina Vincent <sales@allinton.com.sg>
Subject: Confirm #P.O TVOP6436556
Attachment: AETPL-TVOP6436556 P.O JUNE 250520.iso (contains "AETPL-TVOP6436556 P.O JUNE 250520.exe")

RemcosRAT C2:
newdawn4me.ddns.net:7213 (194.5.99.12)

Pointing to nVpn:

% Information related to '194.5.99.0 - 194.5.99.255'

% Abuse contact for '194.5.99.0 - 194.5.99.255' is 'abuse@inter-cloud.tech'

inetnum: 194.5.99.0 - 194.5.99.255
netname: Privacy_Online
remarks: ------------------------------------------------------------------------
remarks: This prefix is used by a non-logging VPN service provider.
remarks: We don't log any user activities.
remarks: We don't host anything else on our servers than VPN software (OpenVPN,
remarks: IKEv1 & 2, WireGuard ...).
remarks: Our customers can open up to 8 Ports (TCP & UDP).
remarks: We support the Tor Project: https://www.torproject.org
remarks: Before sending us potential complaints, please read:
remarks: https://www.torservers.net/abuse.html
remarks:
remarks: We are under constant pressure by Spamhaus.
remarks: Spamhaus issues tons of fake SBL listings in order to destroy our service.
remarks: They use fake identities, violate EU laws and hide outside the EU in
remarks: Andorra to avoid legal consequences.
remarks: Please don't trust this organization.
remarks: If you have any questions related to our service, please contact us
remarks: directly via e-mail: support@inter-cloud.tech
remarks:
remarks: Thank you.
remarks: ------------------------------------------------------------------------
admin-c: RA9926-RIPE
tech-c: RA9926-RIPE
org: ORG-NFAS6-RIPE
country: GB
status: ASSIGNED PA
mnt-by: inter-cloud-mnt
created: 2019-07-20T20:42:53Z
last-modified: 2020-03-10T21:28:31Z
source: RIPE