MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f02671c1ed8c3250c20f7127f30f7a0ac5bd307037d19c0a1ffa8609fab885d4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 3

Intelligence 3 IOCs YARA File information Comments

SHA256 hash:	f02671c1ed8c3250c20f7127f30f7a0ac5bd307037d19c0a1ffa8609fab885d4
SHA3-384 hash:	adea7d596dc8bff3288e97b8073fd52733cb46cf7b0bf7adbdd5b75738504e3211028de4c0a3f30ad6f6460c7f06dd23
SHA1 hash:	fabcc3c5fa5394ecedd466c2d733da3edda72368
MD5 hash:	d0c147d4a36fa424a76e20fc39508d87
humanhash:	ink-blossom-fix-lima
File name:	PROJECT REQUIREMENT_07.20.20.zip
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	380'781 bytes
First seen:	2020-07-20 11:13:38 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	6144:bbXyTeE48tbsI70xXJPJc4YAO002JIlAOBbf5TO3krk9EAAwwk/W8:vXcet8tbf0YReJorkiNww+W8
TLSH	5984236AC49CAFF09BC19B598B3D27DEF176D6D0B2F60511AD064AE903306C50EB0DA7
Reporter	abuse_ch
Tags:	nVpn RAT RemcosRAT zip

abuse_ch

Malspam distributing RemcosRAT:

HELO: vps.poojainfo.net
Sending IP: 37.187.154.154
From: mbautista@midmac.net
Reply-To: mbautista@midmac.net <cbertrand.oeltechnik@dr.com>
Subject: Qatar Airways Accommodation near DIA - Project requirement
Attachment: PROJECT REQUIREMENT_07.20.20.zip (contains "Inquiry_021.exe")

RemcosRAT C2:
185.140.53.4:7289

Hosted on nVpn:

% Information related to '185.140.53.0 - 185.140.53.255'

% Abuse contact for '185.140.53.0 - 185.140.53.255' is 'abuse@privacyfirst.sh'

inetnum: 185.140.53.0 - 185.140.53.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-BE-NL4
country: EU
descr: Zaventem, Belgium
descr: Amsterdam, Netherlands
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2016-10-17T23:24:00Z
last-modified: 2020-07-16T21:16:41Z
source: RIPE