MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b528b21b9d7de9c759e0249ae2d30582255cc370f159eb9cd6a115da0f9923dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 4

Intelligence 4 IOCs YARA File information Comments

SHA256 hash:	b528b21b9d7de9c759e0249ae2d30582255cc370f159eb9cd6a115da0f9923dc
SHA3-384 hash:	8b9be8b15b062251c91f8da23b53a844bcb4de0435f3eac30aa06d77d8cd3aeb2ebcb369206f10a1843ddf6d45e6c0c4
SHA1 hash:	37e5ae8cf9836180c1d080b77887aceb87d945ab
MD5 hash:	a2aca1910990d517fbd73c67b8d5cd22
humanhash:	wyoming-pluto-beryllium-speaker
File name:	Request for quotation and No_863972 order,pdf.lzh
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	407'751 bytes
First seen:	2020-08-31 08:53:51 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	12288:A9ruIkGtpbNPHGBqCXS6H/TRYRj0Ebc1j:ApuJOxmk6HrRqj0v1j
TLSH	FB84230EA457358FFFA484330E7A9BF20ADB42B4D74215995CB2E12EEA0B9C57E70531
Reporter	abuse_ch
Tags:	lzh nVpn RAT RemcosRAT

abuse_ch

Malspam distributing RemcosRAT:

HELO: s1.servidorlatinoamerica.com
Sending IP: 209.236.113.134
From: Ramadhan Saifullah<marketing@leekeegroup.com>
Subject: URGENT PURCHASE ORDER FOR THAILAND MARKET
Attachment: Request for quotation and No_863972 order,pdf.lzh (contains "Request for quotation and No_863972 order,pdf.exe")

RemcosRAT C2:
jackyjian1965.hopto.org:5285 (185.244.30.181)

Pointing to nVpn:

% Information related to '185.244.30.0 - 185.244.30.255'

% Abuse contact for '185.244.30.0 - 185.244.30.255' is 'abuse@privacyfirst.sh'

inetnum: 185.244.30.0 - 185.244.30.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-EU4
country: EU
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2019-10-29T14:10:27Z
last-modified: 2020-07-28T21:04:34Z
source: RIPE