MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 609607861c2e06f60bfcee6bf540d7bb8926566c8a4a11dbd8fb201ae0db98ae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 609607861c2e06f60bfcee6bf540d7bb8926566c8a4a11dbd8fb201ae0db98ae
SHA3-384 hash: b915031b9b6c8d51011594bf4b8dd7fa5f80d2f6ee08c8930d352cc1651aedadb99fb6e035b59ba6e5e4286bbde85256
SHA1 hash: d9db0e94ea2362df6a50efcfc22ea607c77ab019
MD5 hash: 6b66d7ba174ad5c7c0fafd489ef02fc8
humanhash: quebec-papa-november-berlin
File name:RFQ TK011521.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:854'016 bytes
First seen:2021-01-15 13:54:52 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:ZSty0CqDRP0CMY4u/6NtalvsJFXAip9Smmk2+ISK:GTtPN92FwiT7fIj
TLSH E6051951BB819310DBAC22BDDC0640ED16E1EFA9BEA8E71FD58672725F7251400FF682
Reporter abuse_ch
Tags:iso nVpn RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: mail1.promptcheng.com
Sending IP: 164.90.157.21
From: Alexis Pantelides <alexis.p@taskav.com.cy>
Reply-To: Alexis Pantelides <alexis.taskaw.com@dr.com>
Subject: New RFQ TK011521 For TASK
Attachment: RFQ TK011521.iso (contains "RFQ TK011521.exe")

RemcosRAT C2:
jackpiaau.duckdns.org:4902 (194.5.98.165)

Pointing to nVpn:

% Information related to '194.5.98.0 - 194.5.98.255'

% Abuse contact for '194.5.98.0 - 194.5.98.255' is 'abuse@privacyfirst.sh'

inetnum: 194.5.98.0 - 194.5.98.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-NO
country: NO
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2019-04-26T16:42:54Z
last-modified: 2020-10-07T21:35:29Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
188
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs1133.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/609607861c2e06f60bfcee6bf540d7bb8926566c8a4a11dbd8fb201ae0db98ae/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-01-15 10:03:07 UTC
AV detection:
4 of 46 (8.70%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mclapbq4fydpmc745zv7kqgxxoesmvtmrjfbdw6y7mqbvyg3tcxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/609607861c2e06f60bfcee6bf540d7bb8926566c8a4a11dbd8fb201ae0db98ae

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso 609607861c2e06f60bfcee6bf540d7bb8926566c8a4a11dbd8fb201ae0db98ae

(this sample)

RemcosRAT

Executable exe 4cd823b02efc3aaf62baa4f4e9c252ae487d969c887fe2a72291ad2e69359cac

  
Dropping
MD5 1b82291a598a2e1a2b6c6db774ddb5ea
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4cd823b02efc3aaf62baa4f4e9c252ae487d969c887fe2a72291ad2e69359cac

Comments