MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ab7294e85294835410acca76cfc56bb1f7d34b101f4ee45cf19ce865d0fc535e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ab7294e85294835410acca76cfc56bb1f7d34b101f4ee45cf19ce865d0fc535e
SHA3-384 hash: 4f8af55711681ea0684e82205cf636c38765928fd53b0a07aa0eaa65c54a22c5429c4f6413b6fada26cf4423549009cd
SHA1 hash: 7df73d7f0ba4619ca408095a67efbaeac1e663b5
MD5 hash: 987efcdbf598fa35e8294b9fc3fdbdcd
humanhash: purple-spaghetti-music-september
File name:Original BL_pdf.r28
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:20'650 bytes
First seen:2020-12-22 10:31:48 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 384:AduSL5F6HwGYhlGZTBIRGPC0PwXrfTDMQlRrPXLr2/fsqCkhDQeppDcev5:QuwAQxhlGIRGPVPwXj3MQzLLIvCkhhFB
TLSH 5292C0328AC74C6669500962D55B08F9F40C8250FF1F7E3CA32C4F4B82EB539EE9578A
Reporter abuse_ch
Tags:GuLoader nVpn r28 RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: slot0.legrogroup.nl
Sending IP: 45.85.90.83
From: Maersk <info@polrdert.xyz>
Reply-To: swiftlogz@yandex.com
Subject: Re: TOP URGENT MAERSK DELIVERY
Attachment: Original BL_pdf.r28 (contains "Original BL_pdf.scr")

RemcosRAT C2:
wealth.freemyip.com:39777 (185.140.53.175)

Pointing to nVpn:

% Information related to '185.140.53.0 - 185.140.53.255'

% Abuse contact for '185.140.53.0 - 185.140.53.255' is 'abuse@privacyfirst.sh'

inetnum: 185.140.53.0 - 185.140.53.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-EU
country: EU
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2016-10-17T23:24:00Z
last-modified: 2020-11-06T23:02:44Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
440
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.DrodRar-A.2931.25032.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ab7294e85294835410acca76cfc56bb1f7d34b101f4ee45cf19ce865d0fc535e/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vnzjj2csssbviefmzj3m7rllwh35gsyqd5hoixhrttugluh4knpa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ab7294e85294835410acca76cfc56bb1f7d34b101f4ee45cf19ce865d0fc535e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar ab7294e85294835410acca76cfc56bb1f7d34b101f4ee45cf19ce865d0fc535e

(this sample)

RemcosRAT

Executable exe facb3b1bbd388588efa04a3d0a5ba963af70d863494dd180b876d590f8b1bb51

  
URLhaus
https://urlhaus.abuse.ch/url/937674/
  
Dropping
MD5 cb67121eb7faf7f953b30c36ffcf83fd
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 facb3b1bbd388588efa04a3d0a5ba963af70d863494dd180b876d590f8b1bb51

Comments