MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 2af452692d3b63287d9214f6fed23b139df8ede4d495f5cd6fe61de3d21232ed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RemcosRAT
Vendor detections: 12
| SHA256 hash: | 2af452692d3b63287d9214f6fed23b139df8ede4d495f5cd6fe61de3d21232ed |
|---|---|
| SHA3-384 hash: | 07fcd58d481f3385afa193e45afbf937da1d169884568f7a48dc4e9cdb8536e3861a15b1a7e0337889cc03eb1b551b3c |
| SHA1 hash: | 59985aaf342dd147ef2423d3485013cf7ad2be9e |
| MD5 hash: | 11150724b404d0ade8b6fdaf6597f2df |
| humanhash: | red-arkansas-beryllium-item |
| File name: | rPayment_Advice.exe |
| Download: | download sample |
| Signature | RemcosRAT |
| File size: | 490'248 bytes |
| First seen: | 2025-08-20 09:00:10 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 6e7f9a29f2c85394521a08b9f31f6275 (278 x GuLoader, 44 x RemcosRAT, 40 x VIPKeylogger) |
| ssdeep | 12288:xTDJt6Xlu9oCrtcC1VArHKGx9e+0ckgbip4e:xTDJ01u9hfvADxeD94+ |
| TLSH | T173A41261B778C827CA9301B769B19ADAA5749F2609105F0F63A0761CFD7628FCB4E307 |
| TrID | 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10522/11/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1) |
| Magika | pebin |
| dhash icon | 62f98c96cec6e461 (2 x RemcosRAT, 1 x GuLoader) |
| Reporter |  FXOLabs |
| Tags: | exe RemcosRAT signed |
Code Signing Certificate
| Organisation: | Keel |
|---|---|
| Issuer: | Keel |
| Algorithm: | sha256WithRSAEncryption |
| Valid from: | 2025-07-08T09:01:15Z |
| Valid to: | 2026-07-08T09:01:15Z |
| Serial number: | 19b45de209e22ff55859b3aad285029ff9ee8fee |
| Thumbprint Algorithm: | SHA256 |
| Thumbprint: | ce9f9e3ca5d504d7cda1b9dcfb3d28d6e02520e9d54deb57958d0f8754a0d50a |
| Source: | This information was brought to you by ReversingLabs A1000 Malware Analysis Platform |
Intelligence
File Origin
# of uploads :
1
# of downloads :
86
Origin country :
BRVendor Threat Intelligence
Malware family:
remcos
ID:
1
File name:
rPayment_Advice.exe
Verdict:
Malicious activity
Analysis date:
2025-08-20 09:05:23 UTC
Tags:
auto-reg rat remcos remote
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Verdict:
Clean
Score:
89.3%
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Creating a window
Searching for the window
Creating a file in the %temp% subdirectories
Creating a file
Delayed reading of the file
Verdict:
Unknown
Threat level:
2.5/10
Confidence:
100%
Tags:
adaptive-context installer microsoft_visual_cc obfuscated overlay signed
Verdict:
Suspicious
Labled as:
Malware_45.0
Verdict:
Suspicious
Score:
94%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable NSIS Installer PE (Portable Executable) PE File Layout Win 32 Exe x86
Verdict:
Malicious
Threat:
Family.REMCOS
Threat name:
Win32.Trojan.Guloader
Status:
Malicious
First seen:
2025-08-20 06:40:08 UTC
File Type:
PE (Exe)
Extracted files:
9
AV detection:
13 of 24 (54.17%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
remcos
Score:
10/10
Tags:
family:guloader family:remcos botnet:nappy discovery downloader persistence rat
Behaviour
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Loads dropped DLL
Guloader family
Guloader,Cloudeye
Remcos
Remcos family
Malware Config
C2 Extraction:
107.150.0.150:27362
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
2af452692d3b63287d9214f6fed23b139df8ede4d495f5cd6fe61de3d21232ed
MD5 hash:
11150724b404d0ade8b6fdaf6597f2df
SHA1 hash:
59985aaf342dd147ef2423d3485013cf7ad2be9e
SH256 hash:
527f4f602aa934357ea29206dc5dd23b79ed1758b1e45f0ee45f469dd4bb88a9
MD5 hash:
50f6c12cdb11f65b70108b6207e3cc0f
SHA1 hash:
49719a2a895f2bafcae6ad3ab6224e0ff0612940
SH256 hash:
96d1806db4601cf2698d93dfb04c68b790e2afabf6cdefcffa258be44e5e55d4
MD5 hash:
83fadd2662cff48bb764f64512d9fcea
SHA1 hash:
2b3614ea5388f529a9a69120cdf8eb8c8abb7e1e
SH256 hash:
6a37fa43c95954508c4faf5e7a0e0406a32d1bf815932d44a74db864adeb5730
MD5 hash:
cd5bc1ce800b5d9dcd1e6599b809e0b8
SHA1 hash:
302402b8856eab44b6ae4d74894c8a87dcfc3e10
Malware family:
GuLoader
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.62
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | Detect_NSIS_Nullsoft_Installer |
|---|---|
| Author: | Obscurity Labs LLC |
| Description: | Detects NSIS installers by .ndata section + NSIS header string |
| Rule name: | PE_Digital_Certificate |
|---|---|
| Author: | albertzsigovits |
| Rule name: | SUSP_NullSoftInst_Combo_Oct20_1 |
|---|---|
| Author: | Florian Roth (Nextron Systems) |
| Description: | Detects suspicious NullSoft Installer combination with common Copyright strings |
| Reference: | https://twitter.com/malwrhunterteam/status/1313023627177193472 |
| Rule name: | Sus_Obf_Enc_Spoof_Hide_PE |
|---|---|
| Author: | XiAnzheng |
| Description: | Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP) |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.