MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2ac6b7a9b35ffe396321aab670303fc121e596ae3b8699de6b4acf85c5241a59. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2ac6b7a9b35ffe396321aab670303fc121e596ae3b8699de6b4acf85c5241a59
SHA3-384 hash:	885bbfeed4223a42760f013dcb1a1f487c789c4277401fe2a45d37d0bccc80a0a2b2960f584412ee9d7d0d447ebb7a6f
SHA1 hash:	f8e136e2526eb7db5fcc53ba471e8859cd6b553d
MD5 hash:	35d42183d2b0306c2c6268366100712a
humanhash:	tango-timing-apart-sixteen
File name:	shipping_documents.rar
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	7'504 bytes
First seen:	2026-10-21 21:24:27 UTC
Last seen:	2026-10-28 10:47:26 UTC
File type:	rar
MIME type:	application/vnd.rar
ssdeep	192:5VqPuOFG4tNhN7GjCMj9tQrM1e2KH47KDU:GPuVgTNNMj9tIMA2mU
TLSH	T1A5F19E3DACF81007B3A13C38597C7FA9AF823648AEDADC5911B944536FD1D287978049
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	TomU
Tags:	rar RemcosRAT

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

90

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	shipping documents.vbs
File size:	14'951 bytes
SHA256 hash:	2bc204288a0daa2e68c2b016f4a9bea1ccad7b361bfd586fe288d49ffcd73237
MD5 hash:	e931d437223a5a4ce8cdc1ef8af48b76
MIME type:	text/plain
Signature	RemcosRAT

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/aa1c09bc-5543-4f50-9c10-5f9a9424394d/

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.DownLoader.4753.6867.12946.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad7f375afb06e650cd7f635

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

cmd evasive lolbin masquerade obfuscated

Link:

https://www.filescan.io/uploads/6ad92dbfcd26e85791fb71d2/reports/5feed156-b86b-4652-b37c-ffb3d8136e20/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/2ac6b7a9b35ffe396321aab670303fc121e596ae3b8699de6b4acf85c5241a59

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2026-10-20T19:17:00Z UTC

Last seen:

2026-10-23T18:25:00Z UTC

Hits:

~10000

Link:

https://opentip.kaspersky.com/2ac6b7a9b35ffe396321aab670303fc121e596ae3b8699de6b4acf85c5241a59/results?tab=lookup

Malva.RE Malware

Verdict:

Malware

YARA:

1 match(es)

Tags:

COM Behavior Trace DeObfuscated Obfuscated Rar Archive SOS: 0.34 T1027 T1059.005 VBScript WScript.Shell

Link:

https://app.malva.re/file/35d42183d2b0306c2c6268366100712a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2ac6b7a9b35ffe396321aab670303fc121e596ae3b8699de6b4acf85c5241a59/

ReversingLabs TitaniumCloud Script-WScript.Backdoor.Remcos

Threat name:

Script-WScript.Backdoor.Remcos

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-10-21 02:01:30 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

14 of 38 (36.84%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fldlpkntl77dsyzbvk3hamb7yeq6lfvohodjtxtljlhylrjedjmq._file

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:guloader family:remcos botnet:remotehost defense_evasion discovery downloader execution privilege_escalation rat

Link:

https://tria.ge/reports/261022-bbpa9sbz4k/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Executes a command shell one-liner

System Location Discovery: System Language Discovery

Executes a VBScript file via the Windows Script Host.

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Contacts third-party web service commonly abused for C2

Checks computer location settings

Badlisted process makes network request

Family: Guloader,Cloudeye

Family: Remcos

Malware Config

C2 Extraction:

103.83.86.178:2404

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2ac6b7a9b35ffe396321aab670303fc121e596ae3b8699de6b4acf85c5241a59