MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ac66fb874d1b41da756f2aedf38001a509f5a79f9ace94d458ed29c4bc1c2de9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ac66fb874d1b41da756f2aedf38001a509f5a79f9ace94d458ed29c4bc1c2de9
SHA3-384 hash: 849ff8d80e6e7cd2eeade01d89fe90e27930d52ebcdf8f53c16122fb1d8455fc7068bd5d40cd9fb53d766551d387c10a
SHA1 hash: 9c0b6c19b4e32109d3ade332f9fbb0e5d0b25813
MD5 hash: d31a85b6e6dcc3d6387d0ad249b10746
humanhash: lithium-artist-spaghetti-eighteen
File name:DOC1x40,MC, 910159447-MIRAI.r00
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:936'972 bytes
First seen:2020-10-22 06:35:51 UTC
Last seen:2020-10-22 06:37:22 UTC
File type: r00
MIME type:application/x-rar
ssdeep 24576:gmW59F0an6ttIpGm9br4p6si5mkjet/HI05c:259n6DInpprKHzc
TLSH 9B1533B95D1E7028E83503CEE36A39AAAD4F2094455D33F5CFE23B5590ED4E0CE17AA4
Reporter abuse_ch
Tags:nVpn r00 RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: vps.pantin-hoes.com
Sending IP: 45.95.169.163
From: Azumi.C <info@mirai-const.co.jp>
Subject: Re:Best Offer
Attachment: DOC1x40,MC, 910159447-MIRAI.r00 (contains "1x40,MC, 910159447-MIRAI Signed.pdf.exe")

RemcosRAT C2:
petroleum.sytes.net:3014 (185.244.30.10)

Pointing to nVpn:

% Information related to '185.244.30.0 - 185.244.30.255'

% Abuse contact for '185.244.30.0 - 185.244.30.255' is 'abuse@privacyfirst.sh'

inetnum: 185.244.30.0 - 185.244.30.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-HU
country: HU
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2019-10-29T14:10:27Z
last-modified: 2020-10-07T21:39:48Z
source: RIPE

Intelligence

File Origin
# of uploads :
2
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ac66fb874d1b41da756f2aedf38001a509f5a79f9ace94d458ed29c4bc1c2de9/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-21 23:36:32 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vrtpxb2ndna5u5lpflw7haabuue7lj47tlhjjvcy5uu4jpa4fxuq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

r00 ac66fb874d1b41da756f2aedf38001a509f5a79f9ace94d458ed29c4bc1c2de9

(this sample)

RemcosRAT

Executable exe fa5850a0ba8809631d4e3f5a3f8cafa133b3d6ae37088eeb934ec13d1bc9f368

  
Dropping
MD5 0b8b539ff932ee7d37b7dfc04b3cb46e
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fa5850a0ba8809631d4e3f5a3f8cafa133b3d6ae37088eeb934ec13d1bc9f368
  
Dropping
SHA256 7fd8008b67c6137e0e0c5fa56a14e7afc09b72759961c29b97b65ac687012750
  
Dropping
MD5 6f9749641e1ccc12f8737613b4bfbc91

Comments