MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6539aa64de31f9a038c96253ee47a177d3220af335abb1e45e57c1a99ba4e47f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 2

Intelligence 2 IOCs YARA File information Comments

SHA256 hash:	6539aa64de31f9a038c96253ee47a177d3220af335abb1e45e57c1a99ba4e47f
SHA3-384 hash:	141cca6a643bc1ee3e6a2ccbc8ead5069eadd3fbb98fc9ec18d65e32bfc4ba3d1bc32ef7760b9efb436c8ba64779a2e7
SHA1 hash:	7abfbe0cad165b07801e79e220399874b238f9c7
MD5 hash:	df781b75c539c7199edfec146c7b301c
humanhash:	ceiling-salami-seventeen-sierra
File name:	Original Shipping Documents.rar
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	41'866 bytes
First seen:	2020-12-22 10:36:09 UTC
Last seen:	2020-12-22 10:36:29 UTC
File type:	rar
MIME type:	application/x-rar
ssdeep	768:Qwwb7QKcL/j37l2C0Qf023FkSqjQ9vCnyi/e7kVjPor0T0DUeC/PYXKnofJO0CQ:Q9b0KcL/D7lJxfrkp2Cx/7jP9EUeCRn0
TLSH	5813F1992E8F9F903279271AB47FCB61D3EE0AF88D18F954142C2D746C522DC591A43A
Reporter	abuse_ch
Tags:	DHL GuLoader nVpn rar RAT RemcosRAT

abuse_ch

Malspam distributing RemcosRAT:

HELO: vps.jocmachinerys.com
Sending IP: 45.85.90.246
From: noreply@dhl.com <office@jocmachinerys.com>
Reply-To: swiftlogz@yandex.com
Subject: Re: Top Urgent Delivery on transit
Attachment: Original Shipping Documents.rar (contains "DHL Invoice_pdf.scr")

RemcosRAT C2:
wealth.freemyip.com:39777 (185.140.53.175)

Pointing to nVpn:

% Information related to '185.140.53.0 - 185.140.53.255'

% Abuse contact for '185.140.53.0 - 185.140.53.255' is 'abuse@privacyfirst.sh'

inetnum: 185.140.53.0 - 185.140.53.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-EU
country: EU
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2016-10-17T23:24:00Z
last-modified: 2020-11-06T23:02:44Z
source: RIPE