MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1128ee25040218495039229715fc3257f2b6c553b2b59af091d71e2daa08d9fb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 4

Intelligence 4 IOCs YARA File information Comments

SHA256 hash:	1128ee25040218495039229715fc3257f2b6c553b2b59af091d71e2daa08d9fb
SHA3-384 hash:	c627e63bc26bf0e2341d6fbbe91cbcd5e335c0cb471cf60336fcec58a1d041d8a1c3d153d94047af6ccc174ea127f2a3
SHA1 hash:	a869d8e06ac35e94b3dba5d93c0ed28b92b99ddf
MD5 hash:	467544c89714786ffb9666f0ad046d5d
humanhash:	orange-friend-salami-william
File name:	HSBC1A1B2988TT0180120_PDF.iso
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	401'408 bytes
First seen:	2021-01-18 07:09:29 UTC
Last seen:	2021-01-18 07:45:13 UTC
File type:	iso
MIME type:	application/x-iso9660-image
ssdeep	6144:xzz4bs4TQEvq2Tomx93zXAipWQx/JK09NBsvWfcBwsgHnohE478C0O5:J4b7TQEvxo8zRp9B5fcCHnol0O5
TLSH	1784D03475D1C031D153157546B4CBB28EBBB8326AB1B48F7BDE49B95F262E2D22830E
Reporter	abuse_ch
Tags:	HSBC iso nVpn RAT RemcosRAT

abuse_ch

Malspam distributing RemcosRAT:

HELO: mail.olitec.cloud
Sending IP: 93.186.252.9
From: HSBC Advising Service <eadvice29@gtrf.hsbc.com>
Subject: HSBC EXP BILL PAYMENT ADVICE BPPTAI130005 Ref S0B-041,S0B-043 - Ref:[TRDA11551504696]
Attachment: HSBC1A1B2988TT0180120_PDF.iso (contains "HSBC1A1B2988TT0180120_PDF.exe")

RemcosRAT C2:
jackpiaau.duckdns.org:4902 (194.5.98.165)
ihechi.ddns.net:4902 (194.5.98.165)

Pointing to nVpn:

% Information related to '194.5.98.0 - 194.5.98.255'

% Abuse contact for '194.5.98.0 - 194.5.98.255' is 'abuse@privacyfirst.sh'

inetnum: 194.5.98.0 - 194.5.98.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-NO
country: NO
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2019-04-26T16:42:54Z
last-modified: 2020-10-07T21:35:29Z
source: RIPE