MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2ef0cd51e4737c2ff0deceff37d92a3d98ffaf47ac232b1e0292cc3d283fb13e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2ef0cd51e4737c2ff0deceff37d92a3d98ffaf47ac232b1e0292cc3d283fb13e
SHA3-384 hash:	c47a215849ec1ceeb9a30a38a4e4b3706ca02afdcb5ebe6d4c275e18957b8cfe06b0da581e9385178ff38f6a678b276f
SHA1 hash:	bb6cf1a8a3b1821d9de6759cd43bda0bcd2e12c5
MD5 hash:	7e824a137ffb28c90f5cc45761a3152c
humanhash:	massachusetts-undress-double-wolfram
File name:	FedEx_873238334071.js
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	1'742'152 bytes
First seen:	2026-07-20 06:52:49 UTC
Last seen:	2026-07-20 07:49:18 UTC
File type:	js
MIME type:	text/plain
ssdeep	192:uresytViMaWp5f1v1Yr11zEH7QBhS2PImRhdAePq+x82YKFm8BjbbPW:+y6MZr7H7sjI8ShKFhvbPW
TLSH	T1B6859E4EB2CFFED5329B7FD9B60C870DAC10C13A24A332567A8A66E19DC1561F521D32
Magika	javascript
Reporter	lowmal3
Tags:	js RemcosRAT

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

143

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Obfus-201.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a5dc5ffbcffb2c48cb79a4a

Tags:

n/a

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

masquerade repaired

Link:

https://www.filescan.io/uploads/6a5dc5e9534dac5a24ca4621/reports/40794cdd-92c3-4391-9b7f-a6df593e7e2b/overview

Hybrid Analysis Trojan.Cryxos.JS

Verdict:

Malicious

Labled as:

Trojan.Cryxos.JS

Link:

https://www.hybrid-analysis.com/sample/2ef0cd51e4737c2ff0deceff37d92a3d98ffaf47ac232b1e0292cc3d283fb13e

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-07-20T03:27:00Z UTC

Last seen:

2026-07-22T05:33:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/2ef0cd51e4737c2ff0deceff37d92a3d98ffaf47ac232b1e0292cc3d283fb13e/results?tab=lookup

Joe Sandbox Remcos

Result

Threat name:

Remcos

Alert

Create hunting rule

Detection:

malicious

Classification:

expl.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1945019

Signature

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

C2 URLs / IPs found in malware configuration

Contains functionality to bypass UAC (CMSTPLUA)

Contains functionality to inject threads in other processes

Contains functionality to steal Internet Explorer form passwords

Creates processes via WMI

Detected large data written to user environment variables, potentially indicating payload staging for fileless execution

Detected Remcos RAT

Drops script or batch files to the startup folder

Found hidden mapped module (file has been removed from disk)

Found malware configuration

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Sigma detected: Potential Data Stealing Via Chromium Headless Debugging

Sigma detected: Remcos

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes / dynamic malware analysis system (Installed program check)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file registry)

Unusual module load detection (module proxying)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected Powershell decode and execute

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

2%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/2ef0cd51e4737c2ff0deceff37d92a3d98ffaf47ac232b1e0292cc3d283fb13e

Malva.RE

Gathering data

CERT.PL MWDB remcos

Detection:

remcos

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/2ef0cd51e4737c2ff0deceff37d92a3d98ffaf47ac232b1e0292cc3d283fb13e/

ReversingLabs TitaniumCloud Script-JS.Trojan.Cryxos

Threat name:

Script-JS.Trojan.Cryxos

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-20 06:53:45 UTC

File Type:

Binary

AV detection:

10 of 38 (26.32%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=f3ym2upeon6c74g6z37tpwjkhwmp7l2hvqrswhqcslgd2kb7we7a._file

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos botnet:remote execution rat

Link:

https://tria.ge/reports/260720-hnwz7sbz7z/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

Suspicious use of SetThreadContext

Drops startup file

Badlisted process makes network request

Family: Remcos

Process spawned unexpected child process

Malware Config

C2 Extraction:

46.151.182.209:8080

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.85

Link:

https://yomi.yoroi.company/submissions/2ef0cd51e4737c2ff0deceff37d92a3d98ffaf47ac232b1e0292cc3d283fb13e