MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 165bd5cfc46baeefab886b4375416e2ee062f81ae488a551f5636acdeae1a592. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 16


Intelligence 16 IOCs YARA 16 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 165bd5cfc46baeefab886b4375416e2ee062f81ae488a551f5636acdeae1a592
SHA3-384 hash: bc2e3dd5df5d381b982e167156c4c2efc2d70d96674739d2ed017451d575337b7131609835114057cc73d78bf835e699
SHA1 hash: 64709c6fe99d4babf10baa8e26f8ac1d4e58f697
MD5 hash: f4d2abd9141e1f60cd1e518a700e407e
humanhash: river-magazine-wisconsin-august
File name:AWB_411744484099.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:997'376 bytes
First seen:2026-05-21 14:04:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'131 x AgentTesla, 20'159 x Formbook, 12'362 x SnakeKeylogger)
ssdeep 24576:MIxgpEWM+ajGlE4xp28gWqTK5KAbTkCIrdBUjtx7:MhvQF4xp28gWq2Ack9BUZx7
Threatray 3'962 similar samples on MalwareBazaar
TLSH T1332501213BFC5FAAD576C3F95064900517F2B84FA4AAD68A4EDA70DB75B2F010B50E83
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter TomU
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
CH CH
Vendor Threat Intelligence
Malware configuration found for:
Remcos RoboSki
Details
Remcos
a version number and verbose configuration settings
RoboSki
a decrypted ReZer0 component and possibly a decryption component
RoboSki
a Base64 + XOR/Sub-decrypted component, its associated key, a mutex, a filename, and ReZer0 configuration parameters including: a load type, a download URL and filename (if configured), an interval (if configured), and varying flags
Link:
https://research.acce.ciphertechsolutions.com/results/715698bd-c797-4e70-b233-e1cb45aa6c44/
Malware family:
remcos
Create hunting rule
ID:
1
File name:
AWBX411744484099.gz
Verdict:
Malicious activity
Analysis date:
2026-05-21 15:53:34 UTC
Tags:
arch-exec auto-sch-xml remcos
Link:
https://app.any.run/tasks/4d07158b-2ac7-49ed-a922-3c2ec52b559c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/67252/
Detection(s):
SecuriteInfo.com.BackDoor.AgentTesla-25.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a0f17ae98070a72bb9c681b
Tags:
infosteal crypted shell sage
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a process with a hidden window
Creating a file in the %temp% directory
Launching a process
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Sending a custom TCP request
Connection attempt to an infection source
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Gathering data
Verdict:
Malicious
Labled as:
VIPKeylogger.Generic
Link:
https://www.hybrid-analysis.com/sample/165bd5cfc46baeefab886b4375416e2ee062f81ae488a551f5636acdeae1a592
Verdict:
Malicious
File Type:
exe x32
First seen:
2024-08-29T04:29:00Z UTC
Last seen:
2026-05-11T23:13:00Z UTC
Hits:
~1000
Detections:
Trojan-Dropper.Win32.Agent.sb Trojan.MSIL.Taskun.sb Trojan.MSIL.Crypt.sb Trojan-Dropper.Win32.Injector.sb PDM:Trojan.Win32.Generic HEUR:Trojan.MSIL.Agent.gen Backdoor.Win32.Remcos.sb Backdoor.Remcos.HTTP.C&C Trojan.MSIL.Inject.sb HEUR:Trojan.MSIL.Taskun.sb Exploit.Win32.BypassUAC.sb Trojan.Win32.Agent.sb HEUR:Trojan-Spy.MSIL.Noon.gen Backdoor.Win32.Remcos.f Backdoor.Remcos.TCP.C&C
Link:
https://opentip.kaspersky.com/165bd5cfc46baeefab886b4375416e2ee062f81ae488a551f5636acdeae1a592/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b527b60f-ceba-4e0d-b9bc-fe5652a124df
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/165bd5cfc46baeefab886b4375416e2ee062f81ae488a551f5636acdeae1a592
Gathering data
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/165bd5cfc46baeefab886b4375416e2ee062f81ae488a551f5636acdeae1a592/
Threat name:
Win32.Trojan.SnakeKeyLogger
Create hunting rule
Status:
Malicious
First seen:
2024-08-29 11:54:04 UTC
File Type:
PE (.Net Exe)
Extracted files:
24
AV detection:
26 of 36 (72.22%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
wannacryptor
Create hunting rule
unc_loader_037
Create hunting rule
remcos
Create hunting rule
Similar samples:
73d157aceb0cbefa3a24509f157e8b59c40881acd0e3360d026fee5845e19f2c
RemcosRAT
ac56ec5a81bca833585ad1c052dc5614936523763c87ade64f519b23a4f0b24a
RemcosRAT
bac49390230b8d170af75761bf64a3e877b570bea0c9b5ba73dd54a7fab5c351
RemcosRAT
e67ae0c8bca17f912e1fdcc8dacac7e967ac9dfcfc031d944663043c99f32ea7
RemcosRAT
+ 3'952 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:3456789 discovery execution persistence rat
Link:
https://tria.ge/reports/260521-rev6zshv6x/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Family: Remcos
Malware Config
C2 Extraction:
172.93.220.148:45682
Unpacked files
SH256 hash:
165bd5cfc46baeefab886b4375416e2ee062f81ae488a551f5636acdeae1a592
MD5 hash:
f4d2abd9141e1f60cd1e518a700e407e
SHA1 hash:
64709c6fe99d4babf10baa8e26f8ac1d4e58f697
Link:
https://www.unpac.me/results/e9797269-8527-4883-82e6-5fc1cb9dbf5c/
SH256 hash:
8b57a0bf569967168f71c65a9a3fea76d712a114ed75bbf2b5fe50009cef7b1d
MD5 hash:
e14b56671ab9359a74544abff82db87e
SHA1 hash:
06f995c44f40d2655cb00f753a791421896e107e
Detections:
win_remcos_auto
Create hunting rule
win_remcos_w0
Create hunting rule
Remcos
Create hunting rule
Link:
https://www.unpac.me/results/e9797269-8527-4883-82e6-5fc1cb9dbf5c/
Parent samples :
7815d02dd41dd657438b4b226f4ac1a33d6a37159e34448627088e1354f9ab69
31febdf316e73eaa38c90143a5cd2351cdc4f4921ada4f6b053e5f9c2fa3d752
ee4a689891705260239affa76e606afe4bb0e3100770f0f57a27b6367b0bbb40
b3c084f9fd5fe18129978cccf6d2d2ac972d5c7db3a7378372476f535cc16b8e
a9d403efd3d1d5740a5b1d8a0d691422b4cede106265437f533523f2d7bac16e
cb2b849e4d24527ba41c0e5ae3982ecde5bd91b94b5ae8bb27dc221b4c775891
bb982ea4dad990c5c393a7f1fb85a4daf85be97edcb1e1473cdd0703596ecd6d
cf7d328ce0b9c53b4613030296421f1cc710aa391bca418b3e3566db1128cbe5
165bd5cfc46baeefab886b4375416e2ee062f81ae488a551f5636acdeae1a592
61c1041120dd07b3155a6f3d8a0e5e831b1cb37c5ed2b6acb04eb88e4415c2cd
6a53c56172ce6e29d1ab7e14cbd2ad20069637828cbb8a12d240addcf96dd5bc
85508fcc8478cba03aee3434c45853e3887084f48832f53e28da53909a92da14
c59a535b1a8525c8f5714034085bfa0008e5c4bb55f0c39183c07ac3828a7cdd
SH256 hash:
dc283105a4daf69348dc2ce135139c73eef5170ab9d38d6608999340a6d04a12
MD5 hash:
91220b8c44238ac264c74dbb9d661c83
SHA1 hash:
46a1456ce9fb5757232b9f3b854fedb9ff10e2bc
Link:
https://www.unpac.me/results/e9797269-8527-4883-82e6-5fc1cb9dbf5c/
SH256 hash:
c22b6e2cfed3d7e9e0bc312aedb34dd32d9b8049319032ddc7557c9756cf07f7
MD5 hash:
afafe33158d5f82d678539141bbd0455
SHA1 hash:
5746d7bc26825f9bbf73487ee0dd5324d9a19288
Link:
https://www.unpac.me/results/e9797269-8527-4883-82e6-5fc1cb9dbf5c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/165bd5cfc46baeefab886b4375416e2ee062f81ae488a551f5636acdeae1a592

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla_DIFF_Common_Strings_01
Create hunting rule
Author:schmidtsz
Description:Identify partial Agent Tesla strings
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:iexplorer_remcos
Create hunting rule
Author:iam-py-test
Description:Detect iexplorer being taken over by Remcos
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Windows_Trojan_Remcos_b296e965
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.remcos.
Rule name:win_remcos_w0
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in remcos rat Samples.
Rule name:yarahub_win_remcos_rat_unpacked_aug_2023
Create hunting rule
Author:Matthew @ Embee_Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Executable exe 165bd5cfc46baeefab886b4375416e2ee062f81ae488a551f5636acdeae1a592

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/67252/

Comments