MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1806a422212cd1992fa72df78873755c35675b332599f9a7dfd0103711c2d062. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 16


Intelligence 16 IOCs 1 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1806a422212cd1992fa72df78873755c35675b332599f9a7dfd0103711c2d062
SHA3-384 hash: 96b2f09a11a1c7113035883435d4c9c287f6e4ed290e5fa56d1964d65bd25cb8364d4061eef2d648c0f236c94f52d931
SHA1 hash: 8241329b15d58720c572b97464fa6d4dd0a2797b
MD5 hash: 01fe9ec52001743d53b7b82b685b1801
humanhash: texas-magnesium-table-floor
File name:MT103SWIFT.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:879'464 bytes
First seen:2026-01-22 15:25:15 UTC
Last seen:2026-02-05 15:32:20 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 46ce5c12b293febbeb513b196aa7f843 (35 x GuLoader, 21 x RemcosRAT, 5 x VIPKeylogger)
ssdeep 24576:b4rQ/uPAF+L6d7P201YGygzreUutYXnNSk:ErjPG+goGyErzu2sk
Threatray 2'462 similar samples on MalwareBazaar
TLSH T1D8150245B314C957E3950774DCB8FAF02662BFACEB5B4727BB603E59B8732828817112
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10522/11/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon 2b23633b3f2b3323 (5 x GuLoader, 5 x RemcosRAT)
Reporter abuse_ch
Tags:exe RAT RemcosRAT


Avatar
abuse_ch
RemcosRAT C2:
104.168.0.140:2404

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
104.168.0.140:2404 https://threatfox.abuse.ch/ioc/1735561/

Intelligence

File Origin
# of uploads :
2
# of downloads :
162
Origin country :
NL NL
Vendor Threat Intelligence
Malware configuration found for:
NSIS
Details
Link:
https://research.acce.ciphertechsolutions.com/results/9f98cbdb-0354-4696-aae2-111ab382b45c/
Malware family:
remcos
Create hunting rule
ID:
1
File name:
MT103SWIFT.exe
Verdict:
Malicious activity
Analysis date:
2026-01-22 15:25:57 UTC
Tags:
remcos rat
Link:
https://app.any.run/tasks/1143032c-664f-4f70-b66a-5cdee82bcf2a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/49754/
Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69724174bcad3327ec07aa8b
Tags:
injection obfusc virus nsis
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug blackhole installer installer installer-heuristic microsoft_visual_cc nsis signed soft-404
Link:
https://www.filescan.io/uploads/6972416dabc6d3ca6dec004b/reports/04e78d95-3368-4f17-b2dc-33015a9f6878/overview
Verdict:
Malicious
Labled as:
Trojan.DLLhijack
Link:
https://www.hybrid-analysis.com/sample/1806a422212cd1992fa72df78873755c35675b332599f9a7dfd0103711c2d062
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-01-22T03:54:00Z UTC
Last seen:
2026-01-24T02:21:00Z UTC
Hits:
~100
Detections:
Trojan.NSIS.Makoob.sba Trojan.Win32.GuLoader.sb Trojan.Win32.GuLoader.djo Backdoor.Remcos.TCP.C&C Trojan-Downloader.Win32.Minix.sb Trojan.Win32.Agent.sb Trojan.NSIS.Makoob.sbe
Link:
https://opentip.kaspersky.com/1806a422212cd1992fa72df78873755c35675b332599f9a7dfd0103711c2d062/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/38933631-d746-4cf5-a919-961b483d68f5
Result
Threat name:
GuLoader, Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.evad.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1855840
Signature
AI detected suspicious PE digital signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Detected Remcos RAT
Found malware configuration
Installs a global keyboard hook
Multi AV Scanner detection for submitted file
Opens the same file many times (likely Sandbox evasion)
Sigma detected: Remcos
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Unusual module load detection (module proxying)
Yara detected GuLoader
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1806a422212cd1992fa72df78873755c35675b332599f9a7dfd0103711c2d062
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable NSIS Installer PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/01fe9ec52001743d53b7b82b685b1801
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1806a422212cd1992fa72df78873755c35675b332599f9a7dfd0103711c2d062/
Verdict:
Malicious
Threat:
Family.REMCOS
Link:
https://tip.neiki.dev/file/1806a422212cd1992fa72df78873755c35675b332599f9a7dfd0103711c2d062
Threat name:
Win32.Trojan.Sonbokli
Create hunting rule
Status:
Malicious
First seen:
2026-01-22 07:49:48 UTC
AV detection:
6 of 38 (15.79%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dadkiirbftizsl5hfx3yq43vlq2wowztewm7tj672aidoeoc2bra._file
Verdict:
malicious
Label(s):
cloudeye
Create hunting rule
remcos
Create hunting rule
Similar samples:
038da33f8a4482e112b68cd8eb315e10e8a0117a0194b881669c40a41ae0cbc5
RemcosRAT
05c1c274fab9c2dbc679e70b67d748599a1fe6e05f49729ba10af76424460f30
RemcosRAT
067143d4b2fc78bbad00e0a5619b8f8cc587225abc0511fa0e8eaf17c7f7cd46
RemcosRAT
177cfa885f0765b9f144317458a981980d76e123ecc2db7f5b93168bcc8a50a9
RemcosRAT
1806a422212cd1992fa72df78873755c35675b332599f9a7dfd0103711c2d062
RemcosRAT
18ee62de034b56b4677552f8fbcda0ba114c25c40f161b1cfa4190697c3e2293
RemcosRAT
73763f1e185e783f42d48007efb4ea67d05196a461971129e78d3cb3f4c8f6c4
RemcosRAT
9a75a37b7bce57d0936384da613c9623e7d311c7550d9ffb14d723c9b118ae45
RemcosRAT
b77a470abcad2acdddec07438813988ed2fd51fc4215ab1e8b803c7df3f90539
RemcosRAT
error
RemcosRAT
+ 2'452 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:guloader family:remcos botnet:remotehost discovery downloader rat
Link:
https://tria.ge/reports/260122-stw79sfy3c/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Windows directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Contacts third-party web service commonly abused for C2
Loads dropped DLL
Guloader family
Guloader,Cloudeye
Remcos
Remcos family
Malware Config
C2 Extraction:
www.sethrgloballimited.com:2404
www.sethrgloballimitedbackup1.com:2404
www.sethrgloballimitedbackup2.com:2404
Unpacked files
SH256 hash:
1806a422212cd1992fa72df78873755c35675b332599f9a7dfd0103711c2d062
MD5 hash:
01fe9ec52001743d53b7b82b685b1801
SHA1 hash:
8241329b15d58720c572b97464fa6d4dd0a2797b
Link:
https://www.unpac.me/results/0ed7098e-68ff-4243-963b-d405226347af/
SH256 hash:
8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 hash:
9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 hash:
97332a2ffcf12a3e3f27e7c05213b5d7faa13735
Link:
https://www.unpac.me/results/0ed7098e-68ff-4243-963b-d405226347af/
Malware family:
GuLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1806a422212c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1806a422212cd1992fa72df78873755c35675b332599f9a7dfd0103711c2d062

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/49754/

Comments