MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b58d64ef41218a853fd53a4f89a01ec89051e1e510a8aed708942d0cfc55e41c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 4

Intelligence 4 IOCs YARA File information Comments

SHA256 hash:	b58d64ef41218a853fd53a4f89a01ec89051e1e510a8aed708942d0cfc55e41c
SHA3-384 hash:	fc53dd227a5053b642ec978f04c9f0a26fefce1c92f34b76cb436dd0528a7b8cd0aa2046e69c781042fcd1000a9f7e55
SHA1 hash:	87cf06ebf2450413282569af929cdb0275312619
MD5 hash:	1a969a62df66e1d27b2617e9c54888a3
humanhash:	tennis-hydrogen-alpha-vermont
File name:	FH87565635456-18-02-21.iso
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	1'062'912 bytes
First seen:	2021-02-18 14:39:38 UTC
Last seen:	Never
File type:	iso
MIME type:	application/x-iso9660-image
ssdeep	12288:bt1rtR29DwSwNy6ZgFwg0jPacng2WnAH+QIMY6CoDaMycZ+rfF8hW:bnxhSwNy6eFGC+jv+QIP6tDocoJ
TLSH	F63590B1990A4F20F01B673CE48AE63816E6B8BD3D184766DED87B465B5F3183D9007B
Reporter	abuse_ch
Tags:	iso nVpn RAT RemcosRAT

abuse_ch

Malspam distributing RemcosRAT:

HELO: vmmail02.ridsa.com.ar
Sending IP: 190.103.224.9
From: Malcom Braida <info@valmec.com.ar>
Subject: FH87565635456-18-02-21
Attachment: FH87565635456-18-02-21.iso (contains "Nrfgylra.exe")

RemcosRAT C2:
marstonstyl247.ddns.net:5397 (79.134.225.96)

Pointing to nVpn:
% Information related to '79.134.225.0 - 79.134.225.127'

% Abuse contact for '79.134.225.0 - 79.134.225.127' is 'abuse@privacyfirst.sh'

inetnum: 79.134.225.0 - 79.134.225.127
netname: PRIVACYFIRST-EU
country: EU
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
status: ASSIGNED PA
mnt-by: AF15-MNT
org: ORG-TPP6-RIPE
created: 2020-07-14T15:26:02Z
last-modified: 2020-07-14T15:31:06Z
source: RIPE