MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5a3039c6564850098f563e23637cf802a9c5ad004c8c5a87cbddd7bdc984d1d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5a3039c6564850098f563e23637cf802a9c5ad004c8c5a87cbddd7bdc984d1d5
SHA3-384 hash: e30fe3ba7e390964bcebe78e774631d8a718d28684d9841a420b5076539711cd41813f0d96636794a2781a52146760bc
SHA1 hash: e478ed2243a6253e6a9c391f4509ede81e70ad0b
MD5 hash: 983e6c893ca389631431d16d0ad21720
humanhash: spring-carolina-tennis-double
File name:DHL kvittering 8897209547, pdf.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:751'616 bytes
First seen:2020-05-27 11:56:47 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:Ui8qmDnPyX8ylwhz8n4l7OUrYqYwYTtlNdUJIP0+0OzGTREZhIZOqv8:DBeyXKx8n4IUrWtVQl+0Oz3tq0
TLSH 03F48D2EE2E04837F166193D9D0B5774582EBE102A2869467BF8DD4C9FF934D3C26293
Reporter abuse_ch
Tags:DHL iso nVpn RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: vps.ancleald.com
Sending IP: 45.95.169.157
From: DHL Express Cargo <delivery@dhl.com>
Subject: Levering DHL
Attachment: DHL kvittering 8897209547, pdf.iso (contains "DHL kvittering 8897209547, pdf.exe")

RemcosRAT C2:
79.134.225.75:7171

Hosted on nVpn:

% Information related to '79.134.225.64 - 79.134.225.127'

% Abuse contact for '79.134.225.64 - 79.134.225.127' is 'abuse@your-vpn.network'

inetnum: 79.134.225.64 - 79.134.225.127
netname: YOUR_VPN_NETWORK
country: DE
remarks: ****************************************************
remarks: This subnet belongs to a VPN service provider.
remarks: We protect the right to privacy, which means
remarks: we don't log the activities of our users.
remarks: ****************************************************
admin-c: EH4074-RIPE
tech-c: YVN10-RIPE
status: ASSIGNED PA
abuse-c: YVN10-RIPE
org: ORG-YVN1-RIPE
mnt-by: AF15-MNT
created: 2019-07-19T18:26:38Z
last-modified: 2019-07-19T18:51:28Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 12:35:32 UTC
File Type:
Binary (Archive)
Extracted files:
276
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso 5a3039c6564850098f563e23637cf802a9c5ad004c8c5a87cbddd7bdc984d1d5

(this sample)

RemcosRAT

Executable exe ea5f7ceccf5540860f32abe23534330ccb4b5b082d94b2afb5aa1e6d26a1ae56

  
Dropping
MD5 632e3d1eedfc816446787802aad4152f
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ea5f7ceccf5540860f32abe23534330ccb4b5b082d94b2afb5aa1e6d26a1ae56

Comments