MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d0635b08b924a4382b7816ca35739a2fd235816221093e57f7e8dde0a5163374. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 5

Intelligence 5 IOCs YARA File information Comments

SHA256 hash:	d0635b08b924a4382b7816ca35739a2fd235816221093e57f7e8dde0a5163374
SHA3-384 hash:	7effd42d658e3d4e4676efc207c7aa6275477ef869a1907572312b56487f0e6d03b4f2c9de28859994fa4d3e4579f02e
SHA1 hash:	a89bfb02cb5e60f538cc244b5075251e9b6f899a
MD5 hash:	2be7bc7be6fd72c3eca4a594652b5554
humanhash:	triple-london-finch-summer
File name:	Invoice_pdf.gz
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	680'205 bytes
First seen:	2021-01-15 13:51:12 UTC
Last seen:	Never
File type:	gz
MIME type:	application/gzip
ssdeep	12288:ga61r6V9W3aq3MNj0ECesT7xh61OiPnvOSxgfk:ga61r6jWT30jnCV7sOinOSd
TLSH	37E42352214F18973E435F1F8B2738690E33AA24FABC584B45F42B2875773426F9A49F
Reporter	abuse_ch
Tags:	gz nVpn RAT RemcosRAT

abuse_ch

Malspam distributing RemcosRAT:

HELO: atg-glovesolutions.com
Sending IP: 103.145.252.28
From: MAK Trading<import@atg-glovesolutions.com>
Subject: Proforma Invoice
Attachment: Invoice_pdf.gz (contains "Invoice_pdf.exe")

RemcosRAT C2:
welloff.myq-see.com:5267 (91.193.75.197)

Pointing to nVpn:

% Information related to '91.193.75.0 - 91.193.75.255'

% Abuse contact for '91.193.75.0 - 91.193.75.255' is 'abuse@privacyfirst.sh'

inetnum: 91.193.75.0 - 91.193.75.255
descr: Moscow, Russia
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-RU2
country: RU
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
abuse-c: ACRO34258-RIPE
mnt-by: PRIVACYFIRST-MNT
mnt-by: RIPE-NCC-END-MNT
org: ORG-KHd1-RIPE
status: ASSIGNED PI
created: 2012-06-04T11:05:55Z
last-modified: 2021-01-03T20:17:23Z
source: RIPE
sponsoring-org: ORG-MW1-RIPE