MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 940c010936a1b972456fc19a8c44aa0ba3ce2383354b5d54f03497cb96682efd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 940c010936a1b972456fc19a8c44aa0ba3ce2383354b5d54f03497cb96682efd
SHA3-384 hash: 5ad8ed3f015041c4a5b80c8aa09e79bd288a5edf24fe915462284a1ce235f6e340f104ae7308249e2842b0ef504eba54
SHA1 hash: 4fe1712b9e33cba310acad40c44669b302c945e5
MD5 hash: 870c77bdfcb696529a6f4681a24465f1
humanhash: social-blue-robert-quebec
File name:New Doc 20211401_our new price.rar
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:30'201 bytes
First seen:2021-01-21 06:15:40 UTC
Last seen:2021-01-21 08:33:07 UTC
File type: rar
MIME type:application/x-rar
ssdeep 384:5XMn6T5e0xtf+E+2UjLJtcyoKeVQNes0cTxp+J42iWRLV6hRj0RUA8YtYckLq32x:NrdvfKvJteKSQNFTE4GFSKnn+LrEPc
TLSH C0D2E12504EB4C6A357FB5429A502680166AB52803FF4CC9FD8364BD667C0FCFB8B271
Reporter abuse_ch
Tags:nVpn rar RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: mta0.haichufanq.com
Sending IP: 64.227.106.27
From: AMOS GROUP INDUSTRIAL INC <exports@haichufanq.com>
Subject: New Doc 2021//1401#_our new price
Attachment: New Doc 20211401_our new price.rar (contains "New Doc 20211401#_our new price.exe")

RemcosRAT C2:
oluchi.ddns.net:2405 (91.193.75.243)

Pointing to nVpn:

% Information related to '91.193.75.0 - 91.193.75.255'

% Abuse contact for '91.193.75.0 - 91.193.75.255' is 'abuse@privacyfirst.sh'

inetnum: 91.193.75.0 - 91.193.75.255
descr: Moscow, Russia
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-RU2
country: RU
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
abuse-c: ACRO34258-RIPE
mnt-by: PRIVACYFIRST-MNT
mnt-by: RIPE-NCC-END-MNT
org: ORG-KHd1-RIPE
status: ASSIGNED PI
created: 2012-06-04T11:05:55Z
last-modified: 2021-01-03T20:17:23Z
source: RIPE
sponsoring-org: ORG-MW1-RIPE

Intelligence

File Origin
# of uploads :
2
# of downloads :
125
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/940c010936a1b972456fc19a8c44aa0ba3ce2383354b5d54f03497cb96682efd/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sqgaccjwug4xerlpygniyrfkbor44i4dgvfv2vhqgsl4xftif36q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Backdoor
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/940c010936a1b972456fc19a8c44aa0ba3ce2383354b5d54f03497cb96682efd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar 940c010936a1b972456fc19a8c44aa0ba3ce2383354b5d54f03497cb96682efd

(this sample)

RemcosRAT

Executable exe cb3e82e9c93c6b7b44dd782d26d22ad26f323176f8662642397d6d271754768d

  
URLhaus
https://urlhaus.abuse.ch/url/972948/
  
Dropping
MD5 14a7ac7e8a7cc68ee2040ea5f3bb145e
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cb3e82e9c93c6b7b44dd782d26d22ad26f323176f8662642397d6d271754768d

Comments