MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 292ef9c837eb247376d40aec091bac4b2ca4195d15614895cc4629d4b62d4604. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 8

Intelligence 8 IOCs YARA 6 File information Comments

SHA256 hash:	292ef9c837eb247376d40aec091bac4b2ca4195d15614895cc4629d4b62d4604
SHA3-384 hash:	b0d416b7e04471b29490494f9f288388dc658d26f97d978496de0d3bde8231748d211cd3f304062a8861424e45a241e5
SHA1 hash:	eb11ef784534e1b729f551e475904ef29080325f
MD5 hash:	dc733f068184e3adba0100f33a8ee55a
humanhash:	rugby-pluto-ink-pennsylvania
File name:	oustanding!$&()blance500%&00$&09finalrevised.lnk
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	3'163 bytes
First seen:	2025-07-03 10:28:24 UTC
Last seen:	Never
File type:	lnk
MIME type:	application/x-ms-shortcut
ssdeep	48:8WfJhs/qCD4npTX46to/A3gm0lO9pIiLxKpKTai6:8y83EeA3ylO9pjng
Threatray	3 similar samples on MalwareBazaar
TLSH	T17851102516F20218E2B2AB3568F97615CDB3BD26ED35AE4E014C07851B23A00DE24F3F
Magika	lnk
Reporter	cocaman
Tags:	lnk RemcosRAT Shipping

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.28759.LnkHeur.UNOFFICIAL

SecuriteInfo.com.Trojan.DownLoader27.44133.18524.18730.UNOFFICIAL

Gathering data

Result

Verdict:

Malicious

File Type:

LNK File - Malicious

Link:

https://app.docguard.net/292ef9c837eb247376d40aec091bac4b2ca4195d15614895cc4629d4b62d4604/results/dashboard

Behaviour

BlacklistAPI detected

Gathering data

Verdict:

Malicious

Labled as:

BZC.YAX.Pantera.160.5A32BA62;BZC.PZQ.Boxter.928

Link:

https://www.hybrid-analysis.com/sample/292ef9c837eb247376d40aec091bac4b2ca4195d15614895cc4629d4b62d4604

Result

Threat name:

Remcos, GuLoader

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1727899

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

C2 URLs / IPs found in malware configuration

Detected Remcos RAT

Found malware configuration

Found suspicious powershell code related to unpacking or dynamic code loading

Installs a global keyboard hook

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Powershell drops PE file

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Remcos

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Uses dynamic DNS services

Windows shortcut file (LNK) starts blacklisted processes

Yara detected GuLoader

Yara detected LNK With Padded Argument

Yara detected Powershell download and execute

Yara detected Remcos RAT

Behaviour

Behavior Graph:

Download SVG

Verdict:

Malware

YARA:

4 match(es)

Tags:

Batch Command DeObfuscated Execution: CMD in LNK Execution: PowerShell in LNK LNK LOLBin LOLBin:powershell.exe Malicious PowerShell PowerShell Call T1059.001 T1059.003 T1202: Indirect Command Execution T1204.002

Link:

https://app.malva.re/file/dc733f068184e3adba0100f33a8ee55a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/292ef9c837eb247376d40aec091bac4b2ca4195d15614895cc4629d4b62d4604/

Threat name:

Shortcut.Trojan.Pantera

Status:

Malicious

First seen:

2025-07-02 00:45:24 UTC

File Type:

Binary

AV detection:

21 of 36 (58.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fexptsbx5mshg5wublwasg5mjmwkigk5cvqurfomiyu5jnrniyca._file

Verdict:

malicious

Label(s):

cloudeye

RemcosRAT

292ef9c837eb247376d40aec091bac4b2ca4195d15614895cc4629d4b62d4604

RemcosRAT

4c31167d6e80129a4f8ebeae1c6e3109b7d0a19dc33f126d6083cec4795448c7

RemcosRAT

error

RemcosRAT

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Detect_Remcos_RAT Create hunting rule
Author:	daniyyell
Description:	Detects Remcos RAT payloads and commands

Rule name:	EXT_EXPL_ZTH_LNK_EXPLOIT_A Create hunting rule
Author:	Peter Girnus
Description:	This YARA file detects padded LNK files designed to exploit ZDI-CAN-25373.
Reference:	https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html

Rule name:	LNK_sospechosos Create hunting rule
Author:	Germán Fernández
Description:	Detecta archivos .lnk sospechosos

Rule name:	PS_in_LNK Create hunting rule
Author:	@bartblaze
Description:	Identifies PowerShell artefacts in shortcut (LNK) files.

Rule name:	SUSP_LNK_PowerShell Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects the reference to powershell inside an lnk file, which is suspicious

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)