MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bee094614bb5ee9cfc6137a9467060176aab53d23be5afb43d69a48c633aca5e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bee094614bb5ee9cfc6137a9467060176aab53d23be5afb43d69a48c633aca5e
SHA3-384 hash: df8279cf990367cf2a2bf559a95d7912efd18ab5311799f7846616d89ad98d849957d5417d6f6d6001b135f6b465bc85
SHA1 hash: 81e6a592f1db8506fa073c242709230180e668ef
MD5 hash: 9bcc9dddb273a12464e4275c6a3222db
humanhash: coffee-fanta-maryland-pluto
File name:New Order.img
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:2'293'760 bytes
First seen:2021-01-18 07:07:16 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:ps3/7rrM09fj4J5ybH/dGesLNDH+dFaqFV681Os3/7rrM09fj4J5ybH/dGesLNDB:psnreJ5alkVk8SOsnreJ5alkVJ8S
TLSH 95B56C22E5994773C1221ABD5C27E6696834BF4C7928540F37D83D088F762B2392DE6F
Reporter abuse_ch
Tags:img nVpn RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: box.dshuangyang.pw
Sending IP: 192.119.92.206
From: Lazarek <service@dshuangyang.pw>
Subject: New Order
Attachment: New Order.img (contains "Assigned Document.exe")

RemcosRAT C2:
remcos009s.duckdns.org:1980 (185.140.53.220)

Pointing to nVpn:

% Information related to '185.140.53.0 - 185.140.53.255'

% Abuse contact for '185.140.53.0 - 185.140.53.255' is 'abuse@privacyfirst.sh'

inetnum: 185.140.53.0 - 185.140.53.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-EU
country: EU
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2016-10-17T23:24:00Z
last-modified: 2020-11-06T23:02:44Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Trojan.Generic-6629274-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Foxhole.Iso_fs2229.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bee094614bb5ee9cfc6137a9467060176aab53d23be5afb43d69a48c633aca5e/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-01-18 07:08:07 UTC
AV detection:
6 of 46 (13.04%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=x3qjiyklwxxjz7dbg6uum4dac5vkwu6shps27nb5ngsiyyz2zjpa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bee094614bb5ee9cfc6137a9467060176aab53d23be5afb43d69a48c633aca5e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

img bee094614bb5ee9cfc6137a9467060176aab53d23be5afb43d69a48c633aca5e

(this sample)

RemcosRAT

Executable exe ec84a8bda79a0fd968138e6eb7bed4da519a44b4f24f30eceae26606bf73d5f0

  
Dropping
MD5 f8d1358d21f301908cd951fc887d606b
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ec84a8bda79a0fd968138e6eb7bed4da519a44b4f24f30eceae26606bf73d5f0

Comments