MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e62ce223554ab3c5e89167295ed402c2b9ebfedc0b7bfca030d7989c05f1c1e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e62ce223554ab3c5e89167295ed402c2b9ebfedc0b7bfca030d7989c05f1c1e4
SHA3-384 hash: 9275de144dbb83f533a43001c33b0e0bc06bde1794ffedeb56e2af47871997ff507a4602101f8753f3d1855294be5904
SHA1 hash: 485d98d44ad1e303a57ec0a7052dc0af3a5d749e
MD5 hash: 349d4cbc25feada1f3daf441d74d4072
humanhash: illinois-louisiana-helium-delta
File name:Attachment.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'245'184 bytes
First seen:2020-03-29 19:16:32 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:eVDGpUvcog6jm6NVPvPsvh27VlPJ0wToC3DueeA7AolkrRTMywGsbq6K:7qFV3Py8vBHTquAolARTMnG8K
TLSH A24523508D1D2224C225A030A0B5D757CE33B6D945FA61D8334D74BC0FBBB619FA9FA6
Reporter abuse_ch
Tags:COVID-19 GuLoader iso


Avatar
abuse_ch
COVID-19 themed malspam campaign dropping GuLoader->RemcosRAT:

iso->zip->exe

HELO: smmt
Sending IP: 52.162.94.61
From: irs gov <Help@irs.gov>
Subject: Covid-19 Emergency funds Update
Attachment: Attachment.iso (contains "Attached pdf.zip" -> "Attached pdf.exe")

GuLoader payload URL:
https://drive.google.com/u/0/uc?id=1bpSwXgeTfUQhGF7a4lwQmZroVPGuKeUO

RemcosRAT C2:
rex2015.freeddns.org:2404

Resolves to:
185.244.30.125

% Information related to '185.244.30.0 - 185.244.30.255'

% Abuse contact for '185.244.30.0 - 185.244.30.255' is 'abuse@FOS-VPN.org'

inetnum: 185.244.30.0 - 185.244.30.255
netname: Freedom_Of_Speech_VPN
remarks: Before you contact us, please read:
remarks: 185.244.30.0/24 belongs to a NON-LOGGING VPN service.
remarks: We don't log any user activities.
remarks: We believe that the right to informational self-determination and the
remarks: right to privacy are essential to all citizens of all countries.
remarks: We don't host anything else on our servers than VPN software and our
remarks: customers can open a fixed number of Ports.
remarks: Like Public WiFi or Tor Exit Node Operators we cannot be held responsible
remarks: for the actions of our customers, because we simply can't (and to be
remarks: honest: don't want) to control them.
remarks: For further information please read: http://www.torservers.net/abuse.html
country: EU

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Delf
Create hunting rule
Status:
Malicious
First seen:
2020-03-29 19:35:37 UTC
File Type:
Binary (Archive)
Extracted files:
71
AV detection:
16 of 47 (34.04%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4ywoei2vjkz4l2erm4uv5vacyk46x7w4bn57zibq26mjybpryhsa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso e62ce223554ab3c5e89167295ed402c2b9ebfedc0b7bfca030d7989c05f1c1e4

(this sample)

RemcosRAT

Executable exe 8599ded7ef4b89944c5a5330e8608d9e1ab28acd67706284b617ddca1a7d74ab

RemcosRAT

zip 3cb1f0bf9271783543bbeb0f5bfaa4e0d1d62e565e98d932e061d2a9618e15ab

  
URLhaus
https://urlhaus.abuse.ch/url/331738/
  
Dropping
MD5 500fff478e031a7b5e59ab9be3f05ef6
  
Dropping
SHA256 3cb1f0bf9271783543bbeb0f5bfaa4e0d1d62e565e98d932e061d2a9618e15ab
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3cb1f0bf9271783543bbeb0f5bfaa4e0d1d62e565e98d932e061d2a9618e15ab

Comments