MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e7d13c14883b747309b9cc5770d3e9918f8e15bcdfd30bec2729356d77dcc672. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e7d13c14883b747309b9cc5770d3e9918f8e15bcdfd30bec2729356d77dcc672
SHA3-384 hash: c7afd43a936ca91854ea5d5c974ca24cffd17a2cabb421d032a8b7aba93f4d552bd7accbd80f0a4619f0720871e14beb
SHA1 hash: b96b57aaca24fc878bef963b26f1991fdfcde33d
MD5 hash: 5fff0bf26d8d65d07d2d9570431e5558
humanhash: oxygen-virginia-fifteen-floor
File name:request for quotation.img
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'245'184 bytes
First seen:2021-01-14 20:02:51 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:ckkBEJ7/ephY0AWElwH+EmdkE4ZNGStcRNS:ckkCJ72LLalwHAl4ZISeRNS
TLSH E945122112E76B22E4BE5BF45EB4500487B0F4565267E34CBFCE68EA1793B648A01F37
Reporter abuse_ch
Tags:DHL img nVpn RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: mail.domain-serv.com
Sending IP: 89.45.4.217
From: sales <jrramirez@etiqa.com.ph>
Subject: DHL EXPRESS
Attachment: request for quotation.img (contains "Fwd request for quotation.exe")

RemcosRAT C2:
194.5.97.90:1234

Hosted on nVpn:

% Information related to '194.5.97.0 - 194.5.97.255'

% Abuse contact for '194.5.97.0 - 194.5.97.255' is 'abuse@privacyfirst.sh'

inetnum: 194.5.97.0 - 194.5.97.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-UK5
country: GB
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
mnt-by: PRIVACYFIRST-MNT
status: SUB-ALLOCATED PA
created: 2018-07-23T09:31:45Z
last-modified: 2020-08-26T17:48:55Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
152
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen11.57608.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e7d13c14883b747309b9cc5770d3e9918f8e15bcdfd30bec2729356d77dcc672/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-14 20:03:09 UTC
AV detection:
10 of 46 (21.74%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=47ityfeihn2hgcnzzrlxbu7jsghy4fn437jqx3bhfe2w2564yzza._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e7d13c14883b747309b9cc5770d3e9918f8e15bcdfd30bec2729356d77dcc672

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

img e7d13c14883b747309b9cc5770d3e9918f8e15bcdfd30bec2729356d77dcc672

(this sample)

RemcosRAT

Executable exe a982ada2d2ac5c1f57a98aeb33fb4cb64cf90f04aabba376c675f5a7a086fd60

  
Dropping
MD5 10a8dcefb614399d981c930727440c45
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a982ada2d2ac5c1f57a98aeb33fb4cb64cf90f04aabba376c675f5a7a086fd60

Comments