MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 28a35713fe73b7448ce4715d964ce5083762559cad72d725d395128eac891518. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 28a35713fe73b7448ce4715d964ce5083762559cad72d725d395128eac891518
SHA3-384 hash: 52fb4eb09c7dd0b863284ef07b53b08fd57267085cda5c3607697fcc89e7342b4d2a34e7681bda05e3abc69b38671dd1
SHA1 hash: a3cd28a2a06a71e39b89cbbaa638c0771e014bf5
MD5 hash: d79f9b25850f539e80dd9f55387f1e97
humanhash: pluto-kitten-pluto-west
File name:Pago de datos bancarios,zip.zip
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:197'438 bytes
First seen:2020-10-27 16:44:16 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:SPsBzDpOX2ekDq2OdzI2x6VhH9AlKBzQvzXJvay8HhAIZgyiL8GoRXiFQwiSY2A+:SPsxD4FkDq5V8yezQrRp4eIZgIDALpT
TLSH 761423F1A62ED7CBDB93424EB691A41F1B822107DA5EFD401B806FA005E64B1D42DF1F
Reporter abuse_ch
Tags:ESP geo nVpn RAT RemcosRAT zip


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: mail.nipponcarsrl.com.ar
Sending IP: 200.114.86.103
From: Hierrosur <ventas@hierrosur.com.uy>
Subject: Detalles del banco
Attachment: Pago de datos bancarios,zip.zip (contains "Pago de datos bancarios,zip.exe")

RemcosRAT C2:
newlogs.ddns.net:1655 (185.140.53.136)

Pointing to nVpn:

% Information related to '185.140.53.0 - 185.140.53.255'

% Abuse contact for '185.140.53.0 - 185.140.53.255' is 'abuse@privacyfirst.sh'

inetnum: 185.140.53.0 - 185.140.53.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-BE
country: BE
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2016-10-17T23:24:00Z
last-modified: 2020-10-02T20:59:33Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Trojan.Generic-6629274-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/28a35713fe73b7448ce4715d964ce5083762559cad72d725d395128eac891518/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-27 15:24:18 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fcrvoe76oo3ujdheofozmthfba3wevm4vvznojotsuji5lejcuma._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/28a35713fe73b7448ce4715d964ce5083762559cad72d725d395128eac891518

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip 28a35713fe73b7448ce4715d964ce5083762559cad72d725d395128eac891518

(this sample)

RemcosRAT

Executable exe 833b575dac3a049ede0d27e2ff801d2e8d647cf04006f0037e1a9c71d7c8ace4

  
Dropping
MD5 73ccd3185ab04e91e1e8b2fe3a762121
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 833b575dac3a049ede0d27e2ff801d2e8d647cf04006f0037e1a9c71d7c8ace4

Comments