MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3ee3638ba323e21cdfd1f0a29bc3d5307471cf38a25554a0e877eb8f4d9f56b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 4

Intelligence 4 IOCs YARA File information Comments

SHA256 hash:	3ee3638ba323e21cdfd1f0a29bc3d5307471cf38a25554a0e877eb8f4d9f56b9
SHA3-384 hash:	4eca87ef45a80a2e1c83cfcd5864ad623ee4708b2c5b4588c5157714c546166b9e23d77c0d11ff99e01115a898141541
SHA1 hash:	0e27b6f80d4dcf27440ae814549c7330387755ab
MD5 hash:	1fcb89d0f1e18a1ac02d1cee73ce6db4
humanhash:	football-triple-washington-single
File name:	1764AIR200151251-CRE001,pdf.cab
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	340'797 bytes
First seen:	2021-02-01 09:06:36 UTC
Last seen:	2021-02-01 09:14:07 UTC
File type:	cab
MIME type:	application/vnd.ms-cab-compressed
ssdeep	6144:89xYIWZvgOc0JiQI/vq9gi0WYFjvx7wYi+O5spJDRluG8DU4kjX7QxAA98liDp7:+Km/vj2P5sLRsG+s77Qx188J
TLSH	1C74230B49862FC8721FB5CF9B611A234368D7DF159BA8E43D46D96CE8FC764B429C20
Reporter	abuse_ch
Tags:	cab DHL nVpn RAT RemcosRAT

abuse_ch

Malspam distributing RemcosRAT:

HELO: mail2.brandsloveki.com
Sending IP: 209.97.154.18
From: DHL EXPRESS <750172@dhl.com>
Subject: Varış Bildirimi package
Attachment: 1764AIR200151251-CRE001,pdf.cab (contains "1764AIR200151251-CRE001,pdf.SCR")

RemcosRAT C2:
goddywin.freedynamicdns.net:6712 (79.134.225.69)

Pointing to nVpn:

% Information related to '79.134.225.0 - 79.134.225.127'

% Abuse contact for '79.134.225.0 - 79.134.225.127' is 'abuse@privacyfirst.sh'

inetnum: 79.134.225.0 - 79.134.225.127
netname: PRIVACYFIRST-EU
country: EU
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
status: ASSIGNED PA
mnt-by: AF15-MNT
org: ORG-TPP6-RIPE
created: 2020-07-14T15:26:02Z
last-modified: 2020-07-14T15:31:06Z
source: RIPE