MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f0d105b1770efb0e75d76ef01e86f88ac506d4bb0b259a19e1837ec4da196178. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 3

Intelligence 3 IOCs YARA File information Comments

SHA256 hash:	f0d105b1770efb0e75d76ef01e86f88ac506d4bb0b259a19e1837ec4da196178
SHA3-384 hash:	3b07f25756e5685d9bd365ecca2211a323ac6b8077237d889a96013b0692d1f45be0bd94b65fc566577430dda5a1ede5
SHA1 hash:	74262c959015ef4840f67c39b97e586eda9f60da
MD5 hash:	5912e53a833c49eddd743e7f8930b856
humanhash:	bluebird-summer-alabama-alanine
File name:	POS Statements for Date - _22-07-2020.zip
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	293'050 bytes
First seen:	2020-07-22 10:08:01 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	6144:JtfoUR+NGl1C+jcunA2r0Bje/ClYf+oH+I5i73ZXiwWeQug:JtfxR+IX9jFAdBjiCRoH+GMpXiyrg
TLSH	B154236A82401368E89CE15FF3ECB774A2DA1953C6D81C951FD20642B3CE45FBEDE912
Reporter	abuse_ch
Tags:	nVpn RAT RemcosRAT zip

abuse_ch

Malspam distributing RemcosRAT:

HELO: server1.livepotqatar.com
Sending IP: 198.24.151.201
From: POS@dohabank.com.qa
Subject: POS Statements for Date - _22-07-2020
Attachment: POS Statements for Date - _22-07-2020.zip (contains "POS Statements for Date - _22-07-2020.exe")

RemcosRAT C2:
185.165.153.15:6642

Hosted on nVpn:

% Information related to '185.165.153.0 - 185.165.153.255'

% Abuse contact for '185.165.153.0 - 185.165.153.255' is 'abuse@privacyfirst.sh'

inetnum: 185.165.153.0 - 185.165.153.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-AT2
country: AT
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2019-10-18T12:14:26Z
last-modified: 2020-07-14T13:31:45Z
source: RIPE