MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8932701f1fd207aec955483db586205bd81ae4a20e626bcd9c5c4ae21cf6ea95. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8932701f1fd207aec955483db586205bd81ae4a20e626bcd9c5c4ae21cf6ea95
SHA3-384 hash: e69c591f03e4af0059d6d7e1ea581e96c67bee0cbea1d320beefd89131e6500c05d2278a2a1ed771b2ca79a821bd9c79
SHA1 hash: b308d7a6532319ea2b24d4e992d450748af3380b
MD5 hash: fd4aaf7f4e826329406147db917d4ab9
humanhash: pizza-october-foxtrot-yellow
File name:TASK RFQ TK011421.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'249'280 bytes
First seen:2021-01-14 19:15:07 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:GjjnA0wSIbHzqUvHgl8+yRWrufW1xtJPTaeU/lo8E:UjnA0ZI3qUv88+yUzTt05o
TLSH F6451851FB819770FAAC32BD1432073022AEDEA5A2A8D71DF94972665F725D400FFD82
Reporter abuse_ch
Tags:iso nVpn RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: mail10.promptcheng.com
Sending IP: 164.90.157.21
From: Alexis Pantelides <alexis.p@taskav.com.cy>
Reply-To: Alexis Pantelides <alexis.taskaw.com@dr.com>
Subject: Nueva RFQ TK011421 For TASK
Attachment: TASK RFQ TK011421.iso (contains "TASK RFQ TK011421.exe")

RemcosRAT C2s:
ihechi.ddns.net:4902 (194.5.98.165)
jackpiaau.duckdns.org:4902 (194.5.98.165)

Pointing to nVpn:

% Information related to '194.5.98.0 - 194.5.98.255'

% Abuse contact for '194.5.98.0 - 194.5.98.255' is 'abuse@privacyfirst.sh'

inetnum: 194.5.98.0 - 194.5.98.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-NO
country: NO
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2019-04-26T16:42:54Z
last-modified: 2020-10-07T21:35:29Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.22199.14830.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8932701f1fd207aec955483db586205bd81ae4a20e626bcd9c5c4ae21cf6ea95/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-01-14 19:16:06 UTC
AV detection:
7 of 44 (15.91%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rezhahy72id25skvja63lbralpmbvzfcbzrgxtm4lrfoehhw5kkq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8932701f1fd207aec955483db586205bd81ae4a20e626bcd9c5c4ae21cf6ea95

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso 8932701f1fd207aec955483db586205bd81ae4a20e626bcd9c5c4ae21cf6ea95

(this sample)

RemcosRAT

Executable exe 5199dc12c469b0f3ea916ec486beb1ce45714b490186624df71a42a2b26abb7d

  
Dropping
MD5 77bbd1804b806928cedfedac403e6bde
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5199dc12c469b0f3ea916ec486beb1ce45714b490186624df71a42a2b26abb7d

Comments