MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 01839f9f2a2a8bda7fc82e8b42bea771e656fe5f1d93cc5fce365e840c5908eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 3

Intelligence 3 IOCs YARA File information Comments

SHA256 hash:	01839f9f2a2a8bda7fc82e8b42bea771e656fe5f1d93cc5fce365e840c5908eb
SHA3-384 hash:	d6a89c683edb13196f4a1939981173c8d1b3cdce27b1c0f852e624288dcccdd31139a028c71149477e397847613acd8b
SHA1 hash:	45f45d88e7fcb1abbe39058a42dd9a900ac773cf
MD5 hash:	69764e8855fa71ba664010768356c8be
humanhash:	stairway-east-aspen-mountain
File name:	RFQ-SC-DSTPS-3-pdf.zip
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	342'288 bytes
First seen:	2020-07-19 09:12:09 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	6144:0HacpP4XgBJZ37IWGAgubkPdkVvn4VijGysr5AHZ3s6qA:7c94Xgvt7SAguglSn4Yj4r5AHZ3s6L
TLSH	A17423E276F51CE0E8CA4831871B9E36F0628CB67BC5116E3B920B57D429096DF127CE
Reporter	abuse_ch
Tags:	nVpn RAT RemcosRAT zip

abuse_ch

Malspam distributing RemcosRAT:

HELO: new.dtco-qatar.com
Sending IP: 66.84.9.24
From: ppadikkal@ccc.net
Reply-To: ppadikkal@ccc.net <xin.xin01@mail.ru>
Subject: PROJECT: Design & Build of Doha South Terminal Pumping Station
Attachment: RFQ-SC-DSTPS-3-pdf.zip (contains "RFQ-SC-DSTPS-3-pdf.exe")

RemcosRAT C2:
185.140.53.5:6642

Hosted on nVpn:

% Information related to '185.140.53.0 - 185.140.53.255'

% Abuse contact for '185.140.53.0 - 185.140.53.255' is 'abuse@privacyfirst.sh'

inetnum: 185.140.53.0 - 185.140.53.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-BE-NL4
country: EU
descr: Zaventem, Belgium
descr: Amsterdam, Netherlands
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2016-10-17T23:24:00Z
last-modified: 2020-07-16T21:16:41Z
source: RIPE