MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1a87669db3798931f99742c6bc0c40eaa097243f85fbd11af2f524fcbb57bba2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 15


Intelligence 15 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1a87669db3798931f99742c6bc0c40eaa097243f85fbd11af2f524fcbb57bba2
SHA3-384 hash: 7db3bc0b3af373fc84e9d07a92bf30c2d8751bd5bbd7d48ff73e29133ae79e0f771ac8d1666d6244290993f128d5667f
SHA1 hash: 9af0fdebaf75e16ded49c05a748ad17dcb28f78a
MD5 hash: 82cba08ed09ccb1d4c708b83b04181d2
humanhash: berlin-virginia-network-colorado
File name:1a87669db3798931f99742c6bc0c40eaa097243f85fbd11af2f524fcbb57bba2
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:816'648 bytes
First seen:2026-02-05 15:17:45 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'795 x AgentTesla, 19'692 x Formbook, 12'274 x SnakeKeylogger)
ssdeep 24576:D58fmms5x3ZdK4myUFXs6RjaEsTX2lAf75T:umt3u4my56ROX2q7h
Threatray 348 similar samples on MalwareBazaar
TLSH T19405018477A9DB03CA6A0BB00960F179137A6DDEBE51E2039DE57EDFB974F005900A93
TrID 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.0% (.EXE) Win64 Executable (generic) (10522/11/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.2% (.EXE) Win32 Executable (generic) (4504/4/1)
1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
Reporter adrian__luca
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/6055638d-2ff8-49ba-8260-61e4ce1ee7b3/
Malware family:
n/a
ID:
1
File name:
QuarantineMessage (3).zip
Verdict:
No threats detected
Analysis date:
2026-01-19 03:21:56 UTC
Tags:
attachments attc-arch
Link:
https://app.any.run/tasks/af36ff81-83cc-43f9-af64-1b9c70487f3c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/51980/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6984b4c9ae5379bb6609c2ae
Tags:
dropper emotet shell virus
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
agenttesla expired-cert invalid-signature krypt packed remcos signed
Link:
https://www.filescan.io/uploads/6984b4b8930564ff3c8d1a9f/reports/7cd265de-a4fc-4fca-a51d-50822c6a0068/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/1a87669db3798931f99742c6bc0c40eaa097243f85fbd11af2f524fcbb57bba2
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-01-18T23:34:00Z UTC
Last seen:
2026-02-05T05:34:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/1a87669db3798931f99742c6bc0c40eaa097243f85fbd11af2f524fcbb57bba2/results?tab=lookup
Malware family:
KeyBase
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0e00d958-3887-41a6-b8f0-e7d5b225a363
Score:
95%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1a87669db3798931f99742c6bc0c40eaa097243f85fbd11af2f524fcbb57bba2
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.49 Win 32 Exe x86
Link:
https://app.malva.re/file/82cba08ed09ccb1d4c708b83b04181d2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1a87669db3798931f99742c6bc0c40eaa097243f85fbd11af2f524fcbb57bba2/
Threat name:
ByteCode-MSIL.Trojan.PureLogStealer
Create hunting rule
Status:
Malicious
First seen:
2026-01-19 02:22:01 UTC
File Type:
PE (.Net Exe)
Extracted files:
21
AV detection:
25 of 36 (69.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dkdwnhntpgetd6mxildlydca5kqjojb7qx55cgxs6uspzo2xxora._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
2ba48ba616ce16bf1a7b6d8dfbb09f1c984a4c27b11d12b26531992dd4373f23
RemcosRAT
5e6b39d039f9fc05c0262c84b33cdfe703b70df0be1491cb2afa294d344756fd
RemcosRAT
650fb8c1fe8462ddaee07df5613b4832965b8d029846255d46d131c251616823
RemcosRAT
d1c0a9525bf259465de304408570586693062d18f7d59ec854dbc8158acb700b
RemcosRAT
fcdb09f9b63c86b92059cb0c636da21a2daee289a120cff346a7d73b02bdff4e
RemcosRAT
+ 338 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:3-servers discovery execution rat
Link:
https://tria.ge/reports/260205-spr3rahy3e/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Checks computer location settings
Drops startup file
Command and Scripting Interpreter: PowerShell
Remcos
Remcos family
Malware Config
C2 Extraction:
185.156.174.155:42830
146.70.76.35:42830
185.216.35.150:42830
Unpacked files
SH256 hash:
1a87669db3798931f99742c6bc0c40eaa097243f85fbd11af2f524fcbb57bba2
MD5 hash:
82cba08ed09ccb1d4c708b83b04181d2
SHA1 hash:
9af0fdebaf75e16ded49c05a748ad17dcb28f78a
Link:
https://www.unpac.me/results/6c3084be-5033-47c4-9351-c86b91d24d09/
SH256 hash:
f615401d5efc42d4beffda04a66562640a02abdeef8f82a788cb1041efc94880
MD5 hash:
946f9bba7c596fb91e59f0d174ac0c58
SHA1 hash:
37b373e410875dc266b266c7fee1ef77a36f1d85
Detections:
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/6c3084be-5033-47c4-9351-c86b91d24d09/
Parent samples :
b3baa9567f3661525ea666b3c23e427d8550abf4ed4ebc2322121c3616c9cbef
e4ff62b66b02a6f78870344b002d83ae80391d1cc0b1651085f23f28d41f027b
4e104d928c12846758db6ba19844f9fa2482db80fa67c82bb909ebb9e146867a
e64b4314bf8f0471aa3d2db91ad949b3e88e39080524ed613f5a0e1fd29e187b
bfafcc89f89a7e1c6e8767a61b20f1b0875dc6bf5952f012f9c4aac270e3590c
1a87669db3798931f99742c6bc0c40eaa097243f85fbd11af2f524fcbb57bba2
45997dcc03ccfe687fc509e4e688614b059566577e51d70c18b07d250a70e3a0
428d59a68ebf5f9cfdacfab35823e7f4838c53da200072abe7a07c9cb139557d
SH256 hash:
0bcfecfd468de9f7062d471968f2d212cbdaa17b7ac51d181cc7e92c5641b8d5
MD5 hash:
d18de72f578c05d1d2badfe852f02c84
SHA1 hash:
abc4f7a3f0abe682ef20071807dd6a4eb68cad58
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/6c3084be-5033-47c4-9351-c86b91d24d09/
SH256 hash:
4eaae811bcf002475a7f78bcefabbb430fb858592f4146d9ebe6d7ea008780f8
MD5 hash:
3e9133dce853406e1d69d677babc6d91
SHA1 hash:
d78d2412719e2d24ab7ff00f1aab02f2e5069c23
Detections:
win_remcos_auto
Create hunting rule
win_remcos_g0
Create hunting rule
Remcos
Create hunting rule
malware_windows_remcos_rat
Create hunting rule
Remcos
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Link:
https://www.unpac.me/results/6c3084be-5033-47c4-9351-c86b91d24d09/
Parent samples :
650fb8c1fe8462ddaee07df5613b4832965b8d029846255d46d131c251616823
2705f75704043f80705fd0f19b3c38b4253c5c072edd8b183a8664a972107599
77d8ed5b84c1ad1ed17f1f51b6bca57ee8a76e1279f9e5385b269d95bf81b400
1a87669db3798931f99742c6bc0c40eaa097243f85fbd11af2f524fcbb57bba2
70922729b97c0c5d372b02a37927dfaeaae90678a583fd95c3c8b483e1a57e31
081a30496d35fc471cd6e333bbf116f016fd3b9984a17f6d479dceb7c8ce0ca3
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1a87669db3798931f99742c6bc0c40eaa097243f85fbd11af2f524fcbb57bba2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438
Create hunting rule
Author:ditekSHen
Description:Detects executables signed with stolen, revoked or invalid certificates
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/51980/

Comments