🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0e3240de143a5ab975fff0c7fc12fcd8f64cd69fb34ea52afa6ce50709ef8069. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 13


Intelligence 13 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0e3240de143a5ab975fff0c7fc12fcd8f64cd69fb34ea52afa6ce50709ef8069
SHA3-384 hash: 06929c03d90a6891a9028c1290dd803e7c6f0ff40ecc99741fdf6f6f18299e091907e050fb80bf770b68bbf154eb50a8
SHA1 hash: ff449d6ebff8cbd2e7ec3e25b0f21b935d78bbae
MD5 hash: 54963d111ab7eabc0a8dc86b30ec2f72
humanhash: kansas-lemon-maine-lithium
File name:PO-9987.jse
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:20'495 bytes
First seen:2026-11-12 07:31:47 UTC
Last seen:Never
File type:JScript (JSE) jse
MIME type:application/javascript
ssdeep 384:K2aChOyTdtxIsHRKch17t2uavfT2l9dJMg9x3OfLSeeaTsTRQ2b:K2aChOyTdtxIsHRKc77t2uavfT2l9fMg
TLSH T19D925F44594275C493375BBFA266A8A4F37B6A7B00808547F4BCB8406FF2D1DCEE09B2
Magika javascript
Reporter ni_fi_701
Tags:jse RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
AT AT
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.JS.Obfus-2303.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af56b95c48f25399eb55045
Tags:
infosteal injection shell sage
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Connection attempt
Sending an HTTP GET request
Creating a file
Creating a process from a recently created file
Creating a process with a hidden window
Launching a process
Creating synchronization primitives
Sending a custom TCP request
Deleting a recently created file
Reading critical registry keys
Creating a file in the %temp% directory
Unauthorized injection to a recently created process by context flags manipulation
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Malicious
Labled as:
GT:JS.Acsogenixx.7251
Link:
https://www.hybrid-analysis.com/sample/0e3240de143a5ab975fff0c7fc12fcd8f64cd69fb34ea52afa6ce50709ef8069
Verdict:
Malicious
File Type:
js
Link:
https://opentip.kaspersky.com/0e3240de143a5ab975fff0c7fc12fcd8f64cd69fb34ea52afa6ce50709ef8069/results?tab=lookup
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/2004487
Signature
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to register a low level keyboard hook
Contains functionality to steal Internet Explorer form passwords
Contains functionalty to change the wallpaper
Detected Remcos RAT
Found hidden mapped module (file has been removed from disk)
Found malware configuration
Injects a PE file into a foreign processes
Installs a global keyboard hook
JavaScript source code contains functionality to generate code involving a shell, file or stream
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Sigma detected: Script Initiated Connection to Non-Local Network
Sigma detected: Suspicious PowerShell Parameter Substring
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Switches to a custom stack to bypass stack traces
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Unusual module load detection (module proxying)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Yara detected Generic JS Downloader
Yara detected Powershell decode and execute
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 2004487 Sample: PO-9987.jse Startdate: 12/11/2026 Architecture: WINDOWS Score: 100 43 Found malware configuration 2->43 45 Malicious sample detected (through community Yara rule) 2->45 47 Multi AV Scanner detection for submitted file 2->47 49 10 other signatures 2->49 9 wscript.exe 21 2->9         started        process3 dnsIp4 41 141.98.10.201, 24041, 49712, 49713 HOSTBALTICLT Lithuania 9->41 39 C:\Temp\OFWFGPFCMJ.ps1, ASCII 9->39 dropped 63 System process connects to network (likely due to code injection or exploit) 9->63 65 Wscript starts Powershell (via cmd or directly) 9->65 67 Bypasses PowerShell execution policy 9->67 69 3 other signatures 9->69 14 powershell.exe 16 9->14         started        file5 signatures6 process7 signatures8 71 Writes to foreign memory regions 14->71 73 Injects a PE file into a foreign processes 14->73 17 aspnet_compiler.exe 2 1 14->17         started        21 aspnet_compiler.exe 3 6 14->21         started        23 conhost.exe 14->23         started        process9 file10 29 C:\Users\user\AppData\Local\Temp\THEB9F.tmp, PE32 17->29 dropped 51 Contains functionality to bypass UAC (CMSTPLUA) 17->51 53 Detected Remcos RAT 17->53 55 Contains functionalty to change the wallpaper 17->55 61 6 other signatures 17->61 25 iexplore.exe 1 17->25         started        31 C:\Users\user\AppData\...\Login Data.tmp, SQLite 21->31 dropped 33 C:\Users\user\AppData\...\Login Data.tmp, SQLite 21->33 dropped 35 C:\Users\user\...\Login Data For Account.tmp, SQLite 21->35 dropped 37 C:\ProgramData\remcos\logs.dat, data 21->37 dropped 57 Tries to harvest and steal browser information (history, passwords, etc) 21->57 59 Installs a global keyboard hook 21->59 signatures11 process12 process13 27 conhost.exe 25->27         started       
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/0e3240de143a5ab975fff0c7fc12fcd8f64cd69fb34ea52afa6ce50709ef8069
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/0e3240de143a5ab975fff0c7fc12fcd8f64cd69fb34ea52afa6ce50709ef8069/
Threat name:
Script-JS.Dropper.Acsogenixx
Create hunting rule
Status:
Malicious
First seen:
2026-11-12 07:32:27 UTC
File Type:
Text (JavaScript)
AV detection:
6 of 36 (16.67%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=byzebxquhjnls5p76dd7yex43d3ezvu7wnhkkkx2ntsqocppqbuq._file
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost collection discovery execution persistence privilege_escalation rat
Link:
https://tria.ge/reports/261112-jc35tasx6k/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
outlook_office_path
Browser Information Discovery
Command and Scripting Interpreter: JavaScript
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Program Files directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Checks computer location settings
Creates a file in the Startup directory
Badlisted process makes network request
Family: Remcos
Malware Config
C2 Extraction:
141.98.10.201:24041
Malware Family:
acsogenixx
Create hunting rule
Malicious:
True
Tags:
javascript
Link:
https://intel.virussign.com/intelligence/file/0e3240de143a5ab975fff0c7fc12fcd8f64cd69fb34ea52afa6ce50709ef8069
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0e3240de143a5ab975fff0c7fc12fcd8f64cd69fb34ea52afa6ce50709ef8069

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Suspicious_Process
Create hunting rule
Author:Security Research Team
Description:Suspicious process creation
Rule name:SUSP_JS_HexObfuscated_ActiveX_Launcher
Create hunting rule
Author:Marjoriefort
Description:JS obfusque (identifiants _0x) instanciant ActiveX sous WScript - dropper JScript frais
Reference:Veille fraicheur 2026-09-14 / cluster JS _0x
Rule name:SUSP_obfuscated_JS_obfuscatorio
Create hunting rule
Author:@imp0rtp3
Description:Detect JS obfuscation done by the js obfuscator (often malicious)
Reference:https://obfuscator.io
Rule name:SUSP_Script_PowerShell_Hidden_Launcher
Create hunting rule
Author:Marjoriefort
Description:Script (JS/VBS) lancant PowerShell en mode furtif - dropper frais MalwareBazaar
Reference:Veille fraicheur 2026-09-14 / cluster misses web
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments