MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d3e923ae13e15532b388ea9b527af6a75c7036a4f0621b03813fb2803faa2070. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 4

Intelligence 4 IOCs YARA File information Comments

SHA256 hash:	d3e923ae13e15532b388ea9b527af6a75c7036a4f0621b03813fb2803faa2070
SHA3-384 hash:	e9eedf6fdbb71e29345a23544359938c5f56960c22c1ee5d58fe5e38055a037e5b311073e8a0573392585d85d32811a8
SHA1 hash:	459beed63afd47022f082bd80b2d21c21c063a83
MD5 hash:	b07ad552f9e30f14b30b24095f564f81
humanhash:	carpet-diet-don-floor
File name:	C1350095.pdf.z
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	447'961 bytes
First seen:	2020-08-19 11:18:00 UTC
Last seen:	Never
File type:	z
MIME type:	application/x-rar
ssdeep	12288:nogx6CQrWL/aSZgIBVnzSGYi3m/iYsmmXYbnilIkd7u:ogxdL/aOg+I94e2YilIkd7u
TLSH	B194237D16521C0BE44B4A80C047DFD596E3B892A87AD8F2CDDBC13A43DBE053A9D9D8
Reporter	abuse_ch
Tags:	nVpn RAT RemcosRAT z

abuse_ch

Malspam distributing RemcosRAT:

From: arockiamvincent@englam.com.sg
Subject: Re: Attn
Attachment: C1350095.pdf.z (contains "C1350095.exe")

RemcosRAT C2:
salespaul.hopto.org:24005 (194.5.97.12)

Pointing to nVpn:

% Information related to '194.5.97.0 - 194.5.97.255'

% Abuse contact for '194.5.97.0 - 194.5.97.255' is 'abuse@kgb-vpn.org'

inetnum: 194.5.97.0 - 194.5.97.255
netname: NET-NINAZU
remarks: ------------------------------------------
remarks: * This network is used for a VPN service.
remarks: * No logs are stored in any shape or form.
remarks: ------------------------------------------
country: EU
admin-c: NVS100-RIPE
tech-c: NVS100-RIPE
org: ORG-NVS2-RIPE
mnt-by: NINAZU-MNT
status: SUB-ALLOCATED PA
created: 2018-07-23T09:31:45Z
last-modified: 2020-08-02T13:13:48Z
source: RIPE