MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 09c8f5fe9179aa2be034cab55c45a5aaa4032fedb40f17913f974a85d519b267. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 3

Intelligence 3 IOCs YARA File information Comments

SHA256 hash:	09c8f5fe9179aa2be034cab55c45a5aaa4032fedb40f17913f974a85d519b267
SHA3-384 hash:	4f2c05b64a821a60f678e3b03e2f587c689ea7938c5937633d161d030dca64a94f6390b00e0b684d53fc9c289f296f8b
SHA1 hash:	047349767400fa52732600d8c5bf9655991a8b08
MD5 hash:	6ec55d71d0b3a2ee339c26ed88ebd7d6
humanhash:	oklahoma-rugby-hamper-low
File name:	MORCOS OC CVE6535 _TVOP-MIO 10C 2020,pdf.iso
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	622'592 bytes
First seen:	2020-07-09 14:36:22 UTC
Last seen:	Never
File type:	iso
MIME type:	application/x-iso9660-image
ssdeep	12288:Xvldw9ecty5wgPvh3NQFoVvVLrkX6dtOFRlAaB3zBKzI:ffw9DKth3NQFoDLrkXgtYRlAalz8
TLSH	6CD47E32F2D08537D12F1A79CD1B96A8582ABE103D34DC8A7BF92D4C5F39651343A2A7
Reporter	abuse_ch
Tags:	iso nVpn RAT RemcosRAT

abuse_ch

Malspam distributing RemcosRAT:

HELO: mx1.industri.ru
Sending IP: 213.135.75.146
From: Eng. Marc Morcos <marc.morcos@morcosmachinery.com>
Subject: ORDER CONFIRMATION CVE6535
Attachment: MORCOS OC CVE6535 _TVOP-MIO 10C 2020,pdf.iso (contains "MORCOS OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe")

RemcosRAT C2:
anotherlevel.ddns.net:7213 (194.5.99.12)

Pointing to nVpn:

% Information related to '194.5.99.0 - 194.5.99.255'

% Abuse contact for '194.5.99.0 - 194.5.99.255' is 'abuse@inter-cloud.tech'

inetnum: 194.5.99.0 - 194.5.99.255
netname: INTER_CLOUD_SERVICES_RUSSIA
admin-c: ICTR1-RIPE
tech-c: ICTR1-RIPE
org: ORG-ICR2-RIPE
country: RU
status: ASSIGNED PA
mnt-by: inter-cloud-mnt
created: 2019-07-20T20:42:53Z
last-modified: 2020-07-04T13:20:18Z
source: RIPE