MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 69fe5ff35d396f5017ec7f6b5e970c6f6d0e4b6be05f4d7efaeca4e0cf9f7d1f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 3

Intelligence 3 IOCs YARA File information Comments

SHA256 hash:	69fe5ff35d396f5017ec7f6b5e970c6f6d0e4b6be05f4d7efaeca4e0cf9f7d1f
SHA3-384 hash:	5f88011dc82aec649d24f1ac7243b7347e58164ef31e35c7b6aec684d926b10faf8f92f0419c6094e26d5325f0e1eceb
SHA1 hash:	520fbace9ba4c73c9954ddbc5481fc8ced23c042
MD5 hash:	375281b638a067890b08affc4d06e0ca
humanhash:	hydrogen-finch-south-hydrogen
File name:	Urgent order 1812021-672 Q30721,pdf.iso
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	970'752 bytes
First seen:	2021-01-18 07:49:59 UTC
Last seen:	2021-01-18 08:41:49 UTC
File type:	iso
MIME type:	application/x-iso9660-image
ssdeep	12288:pw2ut5cBAII91RrMqxtN9pWs6m4nq0K9F7VU2b0luxzCiydpN:eUI91RrMqxtN9d6m4q0T2b0lNpN
TLSH	9525193D71644B15E8386FF0596483EC8BBEEE591526DE09FCC53AF7EA727018206623
Reporter	abuse_ch
Tags:	iso nVpn RAT RemcosRAT

abuse_ch

Malspam distributing RemcosRAT:

HELO: mail.ciemonteria.co
Sending IP: 104.131.84.225
From: "Mr. BOHDAN G." <info@dynatect.de>
Subject: RE: Purchase order Q307/21
Attachment: Urgent order 1812021-672 Q30721,pdf.iso (contains "Urgent order 1812021-672 Q30721,pdf.exe")

RemcosRAT C2:
goddywin.freedynamicdns.net:2525 (185.140.53.131)

Pointing to nVpn:

% Information related to '185.140.53.0 - 185.140.53.255'

% Abuse contact for '185.140.53.0 - 185.140.53.255' is 'abuse@privacyfirst.sh'

inetnum: 185.140.53.0 - 185.140.53.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-EU
country: EU
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2016-10-17T23:24:00Z
last-modified: 2020-11-06T23:02:44Z
source: RIPE