MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c6ee917e42a8acf8ff228ba9200abaa6650b08c774846e2ade33289b5ff281b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 3

Intelligence 3 IOCs YARA File information Comments

SHA256 hash:	c6ee917e42a8acf8ff228ba9200abaa6650b08c774846e2ade33289b5ff281b6
SHA3-384 hash:	6662644a3bef5f3109300d7dbbe3ae8fd67a8b8696fcc0c44b2241dff6e6dee07bf685671ef887a02da7983cace56d31
SHA1 hash:	bfb5e6227d9f5067345d97f0a2f7ea007a4273a8
MD5 hash:	b7148c5fd55c73c34d9c00e2dd1ac09c
humanhash:	lima-sixteen-beryllium-shade
File name:	Dhl Delivery Shipping Cargo, PDF.iso
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	1'202'176 bytes
First seen:	2021-01-18 07:11:09 UTC
Last seen:	2021-01-18 07:11:22 UTC
File type:	iso
MIME type:	application/x-iso9660-image
ssdeep	24576:ItVPf/55p6dJxdsXQYrrrndnnONTwxFAoSUEfS:Itx/5OdJxOvrrndnqcxFAozt
TLSH	22459E1053DC9F20D3BC56F8A910826067E9E546F658E77CF9BEA0C25F62CA449DFB80
Reporter	abuse_ch
Tags:	DHL iso nVpn RAT RemcosRAT

abuse_ch

Malspam distributing RemcosRAT:

HELO: vps.asswart.com
Sending IP: 45.85.90.28
From: Dhl delivery <delivey@dhl.com>
Subject: Re: DHL Shipping Notification AWB
Attachment: Dhl Delivery Shipping Cargo, PDF.iso (contains "Dhl Delivery Shipping Cargo, PDF.exe")

RemcosRAT C2:
mikegrace2021.ddns.net:1999 (185.244.30.18)

Pointing to nVpn:

% Information related to '185.244.30.0 - 185.244.30.255'

% Abuse contact for '185.244.30.0 - 185.244.30.255' is 'abuse@privacyfirst.sh'

inetnum: 185.244.30.0 - 185.244.30.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-HU
country: HU
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2019-10-29T14:10:27Z
last-modified: 2020-10-07T21:39:48Z
source: RIPE