MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9222b1e86210f04203088f1b4690bcb852fd100d3a51f2e8d2b5eed546860a4e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9222b1e86210f04203088f1b4690bcb852fd100d3a51f2e8d2b5eed546860a4e
SHA3-384 hash: 076d6eb8253312f07a99901f0a5f0343abf36fdc2c2cc5ade1883cfc1f5312907789198f01786e8adab28bdb40ffbe23
SHA1 hash: 040908144968439b330ba77f3c8d6b63b3ce80b8
MD5 hash: 90599b8b2a37c9fb082dd7dc2e74e337
humanhash: cold-fourteen-seventeen-table
File name:New Order - MYTTE1020000208,pdf.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:665'600 bytes
First seen:2020-05-04 17:11:59 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:75XmZNmWOIbbF70XQLOKK5+NuFR6lGWGTZt6:752bbbJB6Is5Zt
TLSH 82E47D22B1D3C633D222197D9C7E537CD826BE132B2424467AF99D4C5FF9791382A293
Reporter abuse_ch
Tags:iso RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: server1-ip22.mailsentinel.net
Sending IP: 111.90.139.246
From: Asyraf <asyraf.raf@taytool.com.my>
Subject: New Order - MYTTE1020000208
Attachment: New Order - MYTTE1020000208,pdf.iso (contains "New Order - MYTTE1020000208,pdf.exe")

RemcosRAT C2:
experience2477.ddns.net:1965 (185.244.30.17)

Pointing to nVpn:

% Information related to '185.244.30.0 - 185.244.30.255'

% Abuse contact for '185.244.30.0 - 185.244.30.255' is 'abuse@FOS-VPN.org'

inetnum: 185.244.30.0 - 185.244.30.255
netname: Freedom_Of_Speech_Foundation_Hungary
remarks: Budapest, Hungary
country: HU
org: ORG-FOSF3-RIPE
admin-c: FOSF1-RIPE
tech-c: FOSF1-RIPE
status: ASSIGNED PA
mnt-by: FOS-VPN-MNT
created: 2019-10-29T14:10:27Z
last-modified: 2020-04-06T19:58:39Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Delf
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 10:33:07 UTC
File Type:
Binary (Archive)
Extracted files:
43
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sirld2dccdyeeayir4nunef4xbjp2eanhji7f2gswxxnkrugbjha._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso 9222b1e86210f04203088f1b4690bcb852fd100d3a51f2e8d2b5eed546860a4e

(this sample)

RemcosRAT

Executable exe 0934b988c71845e7d1594fde5120a0a03e6a961c1f6730684bb329d762eaf0f6

  
Dropping
MD5 ce07878242f541d13f35ba26093081fd
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0934b988c71845e7d1594fde5120a0a03e6a961c1f6730684bb329d762eaf0f6

Comments