MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2c087e91b2e2f57794dcc0fae5cf41fe6212fd83e439391e67c55edc20eabf3b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 4

Intelligence 4 IOCs YARA File information Comments

SHA256 hash:	2c087e91b2e2f57794dcc0fae5cf41fe6212fd83e439391e67c55edc20eabf3b
SHA3-384 hash:	6045b3eb83a6c77f9b14518895caaf5e31a9fb0079e1ea56c97da35157e9480252b833abf1aff55711a4a27acb85f645
SHA1 hash:	adf240cab21340aa1f5ee58704617c7c948bfd31
MD5 hash:	ccb377b31cca3e934c4c5a65b483fd72
humanhash:	bluebird-uniform-white-jupiter
File name:	DHL Detail.img
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	1'245'184 bytes
First seen:	2020-10-17 06:51:49 UTC
Last seen:	Never
File type:	img
MIME type:	application/x-iso9660-image
ssdeep	12288:z8nHBeRNfjODQ34nuhLdNQK7rMSbmHVFwtfqxkg:oHBeRNfjzhLd77QSVtf6
TLSH	71457C3563F04F62E4BBABB485B8500197B97C42142BE3199DC134EB1EFA7009B5B76B
Reporter	abuse_ch
Tags:	DHL img nVpn RAT RemcosRAT

abuse_ch

Malspam distributing RemcosRAT:

HELO: mysmtp4
Sending IP: 13.77.150.206
From: 'DHI Customer Service <customer@dhi.com>
Subject: DHL - Pending delivery
Attachment: DHL Detail.img (contains "z3ZOEume404sYCn.exe")

RemcosRAT C2s:
u875414.nvpn.to:2404 (185.140.53.228)
u875414.duckdns.org
u875414.ddns.net
u875414.nsupdate.info:2404 (91.193.75.93)

Pointing to nVpn:

% Information related to '91.193.75.0 - 91.193.75.255'

% Abuse contact for '91.193.75.0 - 91.193.75.255' is 'abuse@privacyfirst.sh'

inetnum: 91.193.75.0 - 91.193.75.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-KG
country: KG
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
abuse-c: ACRO34258-RIPE
mnt-by: PRIVACYFIRST-MNT
mnt-by: RIPE-NCC-END-MNT
org: ORG-KHd1-RIPE
sponsoring-org: ORG-MW1-RIPE
status: ASSIGNED PI
created: 2012-06-04T11:05:55Z
last-modified: 2020-09-04T11:35:48Z
source: RIPE