MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4558cfbc4ccb6ede310f1d99a934ac03741b5d88ade78300316ca9f0652c72df. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 3

Intelligence 3 IOCs YARA File information Comments

SHA256 hash:	4558cfbc4ccb6ede310f1d99a934ac03741b5d88ade78300316ca9f0652c72df
SHA3-384 hash:	d3408c0ca42e27dceff277fc06e803d25e0be4829e2d182c3cac7a9a5e1c941ef0518b6829a7364866ea55f4153fdb57
SHA1 hash:	710de5b2f09aca949c8ca6cdf97dbc21cd1bd7c7
MD5 hash:	d628504e0785251d15be3a1153fc691b
humanhash:	happy-mexico-kitten-timing
File name:	Quiero hacer el pedido de su producto.iso
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	1'075'200 bytes
First seen:	2021-01-18 16:25:35 UTC
Last seen:	Never
File type:	iso
MIME type:	application/x-iso9660-image
ssdeep	24576:n6ccx/qdJxXIR6fIwaPO3LSRTVeYrbzKctU5L:n6didJx46bSNVeqzKc
TLSH	1C359D21139CCB21EBFC96F9A80151A073A9DE46F668F778D9B6B0D56931D2800DFF81
Reporter	abuse_ch
Tags:	ESP geo iso nVpn RAT RemcosRAT

abuse_ch

Malspam distributing RemcosRAT:

HELO: vps.asswart.com
Sending IP: 45.85.90.28
From: han.nguyen <han.nguyen@ascenti.com.vn>
Subject: Quiero hacer el pedido de su producto
Attachment: Quiero hacer el pedido de su producto.iso (contains "Quiero hacer el pedido de su producto.exe")

RemcosRAT C2:
mikegrace2021.ddns.net:1999 (185.244.30.18)

Pointing to nVpn:

% Information related to '185.244.30.0 - 185.244.30.255'

% Abuse contact for '185.244.30.0 - 185.244.30.255' is 'abuse@privacyfirst.sh'

inetnum: 185.244.30.0 - 185.244.30.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-HU
country: HU
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2019-10-29T14:10:27Z
last-modified: 2020-10-07T21:39:48Z
source: RIPE