MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 581e89004718a881f7912e0a9fcb892e868f4bad10032f0846466a9edf2f18f5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 581e89004718a881f7912e0a9fcb892e868f4bad10032f0846466a9edf2f18f5
SHA3-384 hash: 326d8fee42613525891b434374222f8b14a5c619ba1857c11223ab45e04a6d4d71bac2dfcfea93ee8e3bd9d939d2b4df
SHA1 hash: 7e112ce7ba35a36a579671008f5cb471fd8d0be2
MD5 hash: 0aac29e1f34de148b0d2f2cf6cc7548f
humanhash: river-pluto-tennessee-utah
File name:UPS_DETAILS.ISO
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'310'720 bytes
First seen:2020-06-02 19:15:38 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:KVa3OouGLMvxj4ZV0Ebhs34epfCAyrWThyzfYQ9YYnHdfK:KVdouXxjWSEbhsba6Th4v3Hd
TLSH F0558E33F6A04437D22329799C0BA7B5A93ABE113E24AA4637ECCD9C4F7D7417529183
Reporter abuse_ch
Tags:Azure iso nVpn RAT RemcosRAT UPS


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: dddd3.eastus.cloudapp.azure.com
Sending IP: 13.82.24.191
From: "UPS Customer Service" <customer@ups.com>
Subject: UPS - Pending delivery
Attachment: UPS_DETAILS.ISO (contains "read.exe")

RemcosRAT C2:
185.244.30.223:2404

Hosted on nVpn:

% Information related to '185.244.30.0 - 185.244.30.255'

% Abuse contact for '185.244.30.0 - 185.244.30.255' is 'abuse@FOS-VPN.org'

inetnum: 185.244.30.0 - 185.244.30.255
netname: Freedom_Of_Speech_Foundation_Hungary
remarks: Budapest, Hungary
country: HU
org: ORG-FOSF3-RIPE
admin-c: FOSF1-RIPE
tech-c: FOSF1-RIPE
status: ASSIGNED PA
mnt-by: FOS-VPN-MNT
created: 2019-10-29T14:10:27Z
last-modified: 2020-04-06T19:58:39Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 19:35:51 UTC
File Type:
Binary (Archive)
Extracted files:
46
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lapisachdcuid54rfyfj7s4jf2di6s5ncabs6ccgizvj5xzpdd2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso 581e89004718a881f7912e0a9fcb892e868f4bad10032f0846466a9edf2f18f5

(this sample)

RemcosRAT

Executable exe dd6cc40b98ec4d9c1413705c105d03f94afcfdc1258a5ab8c39342e71f67e2f9

  
Dropping
MD5 5bfe795c527cd80715e02ae1860fca9b
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dd6cc40b98ec4d9c1413705c105d03f94afcfdc1258a5ab8c39342e71f67e2f9

Comments