MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9153384cd8f1cd613f164764f1e1cabd1a47cfba2e97d8487a19e55f71689504. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9153384cd8f1cd613f164764f1e1cabd1a47cfba2e97d8487a19e55f71689504
SHA3-384 hash: 8f456d571e7466e74becec696a2b8bbeafe29ada2c6ac9701c90045d66c5d323ebb09a7ac219268c3fa4c3105efa6db3
SHA1 hash: 3508847a782412c0be60cfccf71b3ff20d611d10
MD5 hash: 6ab4527bd94d56c1aef3fb21602ec627
humanhash: diet-july-alabama-fruit
File name:DHL Delivery Shipping Cargo. Pdf.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:724'992 bytes
First seen:2021-01-20 06:29:26 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:V6shOvJoORJCSBm7XO1mGAXxqlf9s9Dqm88SCo42Y1e0LwmmtWMq2bgu82vfDQaA:a8jgYUGwmmWMr0uFvNE6IJQWt/
TLSH 4FF4E0252788DB96D1BD43346065457003F1BD029722E71E7EAC39AE2F73BA18633B5B
Reporter abuse_ch
Tags:DHL iso nVpn RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: vps.asswart.com
Sending IP: 45.85.90.28
From: Dhl delivery <delivey@dhl.com>
Subject: DHL delivery Cargo
Attachment: DHL Delivery Shipping Cargo. Pdf.iso (contains "DHL Delivery Shipping Cargo. Pdf.exe")

RemcosRAT C2:
mikegrace2021.ddns.net:1999 (185.244.30.18)

Pointing to nVpn:

% Information related to '185.244.30.0 - 185.244.30.255'

% Abuse contact for '185.244.30.0 - 185.244.30.255' is 'abuse@privacyfirst.sh'

inetnum: 185.244.30.0 - 185.244.30.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-HU
country: HU
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2019-10-29T14:10:27Z
last-modified: 2020-10-07T21:39:48Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
142
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_badexts66.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9153384cd8f1cd613f164764f1e1cabd1a47cfba2e97d8487a19e55f71689504/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-01-20 03:55:01 UTC
AV detection:
7 of 46 (15.22%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sfjtqtgy6hgwcpywi5spdyokxunept52f2l5qsd2dhsv64lisuca._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Backdoor
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9153384cd8f1cd613f164764f1e1cabd1a47cfba2e97d8487a19e55f71689504

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso 9153384cd8f1cd613f164764f1e1cabd1a47cfba2e97d8487a19e55f71689504

(this sample)

RemcosRAT

Executable exe 09be972858f7ed888f35048caf1f20787063e5b26777446b5ae5fa621fd577f4

  
Dropping
MD5 aecd80e489a97289022b0dd07323a6b5
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 09be972858f7ed888f35048caf1f20787063e5b26777446b5ae5fa621fd577f4

Comments