MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4b3be36cd89b2c6839ce4b0139296e85be8f0557209d6e82a42e718644ef60a7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 3

Intelligence 3 IOCs YARA File information Comments

SHA256 hash:	4b3be36cd89b2c6839ce4b0139296e85be8f0557209d6e82a42e718644ef60a7
SHA3-384 hash:	4a4e9249ab2dbfa039569843d52d2a9d7f3121d36512800aea10d088ec73e6bc32ce997b04d20308867671a77e0d1d2c
SHA1 hash:	e86dc5b54a614c50f5aa5ebf0bd79a6eb7b0a768
MD5 hash:	8cdf3667bf17366eb0cedae38a433d5b
humanhash:	wisconsin-fish-delta-bakerloo
File name:	75720 INV- from Outriger.zip
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	262'814 bytes
First seen:	2020-08-08 09:03:40 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	6144:cmn5vKywxZI5of+2vOvg9JM3Ln5Lm2NGcSDbGAx7QK:c4K/+2vXin5Lm20cS3NN
TLSH	1A442332CD0059071FDAB5C646ED8A88CC92E47E929987752137ADF8F6D3CA2329CD54
Reporter	abuse_ch
Tags:	nVpn RAT RemcosRAT zip

abuse_ch

Malspam distributing RemcosRAT:

HELO: cloudhost-150218.us-midwest-1.nxcli.net
Sending IP: 104.207.254.25
From: Mr. Kim Sung Hae (Overseas Sales/Purchase) <sales@outriger.biz>
Reply-To: mm1045725@gmail.com
Subject: Re: 75720 INV- from Outriger General Importers Korea for acknowledgment
Attachment: 75720 INV- from Outriger.zip (contains "75720 INV- from Outriger.exe")

RemcosRAT C2:
john777.ddns.net:6640 (185.140.53.34)

Pointing to nVpn:

% Information related to '185.140.53.0 - 185.140.53.255'

% Abuse contact for '185.140.53.0 - 185.140.53.255' is 'abuse@privacyfirst.sh'

inetnum: 185.140.53.0 - 185.140.53.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-EU3
country: EU
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2016-10-17T23:24:00Z
last-modified: 2020-07-28T20:56:03Z
source: RIPE