MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f8f89c5cb4eb79e76d14910bb26abb22debd2e477cebd42f9351e8b2cab51ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 16

Intelligence 16 IOCs YARA 40 File information Comments

SHA256 hash:	1f8f89c5cb4eb79e76d14910bb26abb22debd2e477cebd42f9351e8b2cab51ba
SHA3-384 hash:	1c8d54a740a546bd843fbdd3c1b7dec6f78232ff7fcbb5400a911becd095ff4975907419cacb78f2faf86cf70f6d87ee
SHA1 hash:	1b2a948fe922512a6b1a3c6a304f5cadd267172d
MD5 hash:	1d1b41cea6253c1f87c94bcbcd0ccb02
humanhash:	kentucky-lion-queen-double
File name:	RAVBg64.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	1'606'960 bytes
First seen:	2026-11-09 14:20:02 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	1fc39dc9d4aa234c524dfa2f97e8b7e0 (6 x RemcosRAT)
ssdeep	24576:zaTg0wZ14X27uUL3VM0kd+rkhfMsjgkAj2JE06J5N0Fl:+Tg3ZOcuUL3xAx/8b2S7Z0b
TLSH	T12B7523FA8E706892D5BD563205AF0F6D35F54FF37A14AC4311713D2A2F3A267A920A1C
TrID	45.6% (.EXE) Win32 EXE PECompact compressed (v2.x) (59069/9/14) 32.1% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9) 5.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 5.0% (.EXE) Win64 Executable (generic) (6522/11/2) 3.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika	pebin
dhash icon	589d21717b1b8666 (6 x RemcosRAT)
Reporter	qemped
Tags:	exe RemcosRAT

Intelligence

File Origin

# of uploads :

# of downloads :

177

Origin country :

Vendor Threat Intelligence

No detections

Detection:

Remcos

Link:

https://www.capesandbox.com/analysis/98807/

Detection(s):

Win.Trojan.Nymeria-6895336-0

Gathering data

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating synchronization primitives

Unauthorized injection to a recently created process

Restart of the analyzed sample

Connection attempt to an infection source

Launching a service

Creating a file in the %AppData% subdirectories

Enabling the 'hidden' option for recently created files

Adding an access-denied ACE

Launching a process

Creating a process with a hidden window

Creating a process from a recently created file

Setting a global event handler for the keyboard

Query of malicious DNS domain

Enabling autorun by creating a file

Gathering data

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/1f8f89c5cb4eb79e76d14910bb26abb22debd2e477cebd42f9351e8b2cab51ba

Verdict:

Malicious

File Type:

exe x32

Link:

https://opentip.kaspersky.com/1f8f89c5cb4eb79e76d14910bb26abb22debd2e477cebd42f9351e8b2cab51ba/results?tab=lookup

Result

Threat name:

Remcos

Detection:

malicious

Classification:

rans.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/2001754

Behaviour

Behavior Graph:

n/a

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE Memory-Mapped (Dump)

Link:

https://app.malva.re/file/1d1b41cea6253c1f87c94bcbcd0ccb02

Detection:

remcos

Link:

https://mwdb.cert.pl/sample/1f8f89c5cb4eb79e76d14910bb26abb22debd2e477cebd42f9351e8b2cab51ba/

Threat name:

Win32.Backdoor.Remcos

Status:

Suspicious

First seen:

2026-11-07 23:14:00 UTC

AV detection:

20 of 24 (83.33%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=d6hytrolj23z45wrjeilwjvlwiw6xuxeo7hl2qxzgupiwlflkg5a._file

Verdict:

malicious

Label(s):

Remcos

Link:

https://reports.threatray.com/ad22bd7b-e5bf-413a-93ef-509ab8fb993b

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos botnet:chinemerem discovery execution persistence rat

Link:

https://tria.ge/reports/261109-rnh8sagb25/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

AutoIT Executable

Suspicious use of SetThreadContext

Checks computer location settings

Executes dropped EXE

Family: Remcos

Malware Config

C2 Extraction:

remcoss.onmypc.org:3765

Malware Family:

n/a

Verdict:

Malicious

Tags:

injector stealer rat

YARA:

n/a

Link:

https://app.threat.zone/submission/3ba6f50b-c624-46fd-84a0-4461ad4fddc2

Malware Family:

remcos

Malicious:

True

Tags:

peexe pecompact file-overlay

Link:

https://intel.virussign.com/intelligence/file/1f8f89c5cb4eb79e76d14910bb26abb22debd2e477cebd42f9351e8b2cab51ba

Unpacked files

SH256 hash:

1f8f89c5cb4eb79e76d14910bb26abb22debd2e477cebd42f9351e8b2cab51ba

MD5 hash:

1d1b41cea6253c1f87c94bcbcd0ccb02

SHA1 hash:

1b2a948fe922512a6b1a3c6a304f5cadd267172d

Link:

https://www.unpac.me/results/83a482c8-eb92-40f0-8df9-5133c4060a63/

SH256 hash:

100e25ba64a2b1fc535a99d25d7b7c73d0fa9759a20c09ae37fc03a148dfc5d5

MD5 hash:

6cca7f60e3038fa35e8ab5d9ad998bdf

SHA1 hash:

690b29b67fd359bb830841b7decf21955ba2821a

Detections:

Remcos

win_remcos_auto

win_remcos_g0

INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer

malware_windows_remcos_rat

Parallax

Remcos

Link:

https://www.unpac.me/results/83a482c8-eb92-40f0-8df9-5133c4060a63/

Parent samples :

1f8f89c5cb4eb79e76d14910bb26abb22debd2e477cebd42f9351e8b2cab51ba
f86620cdb7e1c2cd1969cf15bb6d1922ccd20d18a67b5a0d57469e1e0b976ad9
c0c60b160af46d02e1e86e3ddc02e4b35bb3a827698eb23e62f98444af1734cc
399a542f0c9ef085721361ba3cd4a49b01b3031fa77399adf7970055a62c5f39

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1f8f89c5cb4eb79e76d14910bb26abb22debd2e477cebd42f9351e8b2cab51ba

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_RemcosRAT Create hunting rule
Author:	abuse.ch

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer Create hunting rule
Author:	ditekSHen
Description:	detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Rule name:	malware_Remcos_strings Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Remcos in memory

Rule name:	Parallax Create hunting rule
Author:	@bartblaze
Description:	Identifies Parallax RAT.

Rule name:	pecompact2 Create hunting rule
Author:	Kevin Falcoz
Description:	PECompact

Rule name:	PECompact2xxBitSumTechnologies Create hunting rule
Author:	malware-lu

Rule name:	PECompactV2XBitsumTechnologies Create hunting rule
Author:	malware-lu

Rule name:	PECompactv2xx Create hunting rule
Author:	malware-lu

Rule name:	rat_win_remcos Create hunting rule
Author:	Sekoia.io
Description:	DEPRECATED : Find Remcos RAT samples based on specific strings

Rule name:	Remcos Create hunting rule
Author:	kevoreilly
Description:	Remcos Payload

Rule name:	remcos_rat Create hunting rule
Author:	jeFF0Falltrades

Rule name:	REMCOS_RAT_variants Create hunting rule

Rule name:	SUSP_VBS_Wscript_Shell Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects the definition of 'Wscript.Shell' which is often used by Malware, FPs are possible and commmon

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	VIGIA_RemcosRAT_067b3e47 Create hunting rule
Author:	VIG-IA - Cognitive Threat Intelligence System for Smart Territories and Tourism Sector
Description:	Remcos RAT indicators with corroborated family detection and original-sample coverage
Reference:	https://vigia.bisite.es/

Rule name:	VIGIA_RemcosRAT_12bf67c7 Create hunting rule
Author:	VIG-IA - Cognitive Threat Intelligence System for Smart Territories and Tourism Sector
Description:	4ecda9dd-c048-413e-8ff4-2532f2e4d6eb - RemcosRAT family and corroborated behavioral indicators
Reference:	https://vigia.bisite.es/

Rule name:	VIGIA_RemcosRAT_3ca3d51f Create hunting rule
Author:	VIG-IA - Cognitive Threat Intelligence System for Smart Territories and Tourism Sector
Description:	b36f2418-9ab3-419b-8c15-e3b00eacabeb - RemcosRAT indicators and original NSIS-packaged sample
Reference:	https://vigia.bisite.es/

Rule name:	VIGIA_RemcosRAT_614e3ab4 Create hunting rule
Author:	VIG-IA - Cognitive Threat Intelligence System for Smart Territories and Tourism Sector
Description:	RemcosRAT configuration and corroborated diagnostic indicators
Reference:	https://vigia.bisite.es/

Rule name:	VIGIA_RemcosRAT_8ac92158 Create hunting rule
Author:	VIG-IA - Cognitive Threat Intelligence System for Smart Territories and Tourism Sector
Description:	RemcosRAT indicators with corroborated keylogging, credential-access, and scripted execution behavior
Reference:	https://vigia.bisite.es/

Rule name:	VIGIA_RemcosRAT_be11e16d Create hunting rule
Author:	VIG-IA - Cognitive Threat Intelligence System for Smart Territories and Tourism Sector
Description:	c0de03d4-e1e8-4c08-a5f7-4c330428829f - RemcosRAT activity messages and correlated behaviors
Reference:	https://vigia.bisite.es/

Rule name:	VIGIA_RemcosRAT_e53b23f6 Create hunting rule
Author:	VIG-IA - Cognitive Threat Intelligence System for Smart Territories and Tourism Sector
Description:	RemcosRAT indicators with an original-sample recovery pathway
Reference:	https://vigia.bisite.es/

Rule name:	VIGIA_RemcosRAT_ff27f58a Create hunting rule
Author:	VIG-IA - Cognitive Threat Intelligence System for Smart Territories and Tourism Sector
Description:	b4b5dbd4-831c-469c-936d-1597b391378e - RemcosRAT diagnostic strings and corroborated behaviors
Reference:	https://vigia.bisite.es/

Rule name:	Windows_Generic_Threat_994f2330 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_Remcos_b296e965 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set

Rule name:	Win_Clipboard_Clipper_Thengavar Create hunting rule
Author:	Thengavar
Description:	Detects malware manipulating the Windows clipboard for clipping or crypto stealing attacks

Rule name:	WIN_Malware_ACRStealer_ForgeAuto_1084c837_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects ACRStealer (pe, etat extrait)

Rule name:	WIN_Malware_Unknown_ForgeAuto_2e3a5916_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

Rule name:	WIN_Malware_Unknown_ForgeAuto_30f84f37 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_37b4704b Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_74566f98 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_79234c04 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_b26e2de9_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.remcos.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/98807/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample