🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 30deabad46eac71fa6811b61dd481cd3103a52a6e6911c996d5c61fc2a5ea85f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 11


Intelligence 11 IOCs YARA 22 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 30deabad46eac71fa6811b61dd481cd3103a52a6e6911c996d5c61fc2a5ea85f
SHA3-384 hash: 02e23aeb0dc0dd4efaccada48947362cbf60a1f3802c07fba0f04d651926bb489856f7a54d17ee3bfc505b602acd3b28
SHA1 hash: 18b9e5a01b80c4ccaa06fdee39270fa0c2a74df4
MD5 hash: 365cc5f6610671f6f3818e2a0e078fdd
humanhash: nineteen-april-connecticut-dakota
File name:Quotation.js
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'053'210 bytes
First seen:2025-11-07 07:03:18 UTC
Last seen:2025-11-07 07:05:17 UTC
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 12288:KLmY9cYTktpZIn3C3EviUDuZyPXBxYIRNDfOPv+iQwzfzkTBQ0LH:KLmY9cYTsHq3C3EtSZWqOfOPDQsr0L
Threatray 182 similar samples on MalwareBazaar
TLSH T14D25E37DEEE7B9F2395EDB5139A0698C2F190176DF5B1C040010FBA221E62D95ECF4A8
Magika javascript
Reporter lowmal3
Tags:js RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
134
Origin country :
DE DE
Vendor Threat Intelligence
Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=690d99f23afb53888cc93e7c
Tags:
obfuscate autorun xtreme shell
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
repaired
Link:
https://www.filescan.io/uploads/690d99f2811c0c37f10973d7/reports/cde8ee46-f554-4bbc-af43-5c2c1e3f41e4/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/30deabad46eac71fa6811b61dd481cd3103a52a6e6911c996d5c61fc2a5ea85f
Verdict:
Malicious
File Type:
js
First seen:
2025-11-06T20:27:00Z UTC
Last seen:
2025-11-09T05:31:00Z UTC
Hits:
~1000
Detections:
Trojan.PowerShell.AmsiBypass.sb Trojan-Dropper.Win32.Injector.qcik Trojan.JS.SAgent.sb HEUR:Trojan.PowerShell.Tesre.sb PDM:Trojan.Win32.Generic HEUR:Trojan.Script.SAgent.gen HEUR:Trojan.Script.Generic Trojan-PSW.Win32.Stealer.sb Trojan.BAT.Agent.sb Backdoor.Remcos.TCP.C&C Trojan.Win32.Shellcode.sb VHO:Trojan-PSW.Win32.Greedy.gen HEUR:Trojan.BAT.Tesre.gen Trojan-Downloader.JS.Cryptoload.sb Trojan.VBS.SAgent.sb HEUR:Trojan-Downloader.Script.Generic not-a-virus:HEUR:PSWTool.Win32.PassView.b not-a-virus:HEUR:PSWTool.Win32.PassView.a not-a-virus:HEUR:PSWTool.Win32.PassView.c
Link:
https://opentip.kaspersky.com/30deabad46eac71fa6811b61dd481cd3103a52a6e6911c996d5c61fc2a5ea85f/results?tab=lookup
Result
Threat name:
Remcos, DonutLoader
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1809759
Signature
.NET source code contains a sample name check
.NET source code references suspicious native API functions
Antivirus detection for dropped file
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Creates processes via WMI
Detected Remcos RAT
Disable UAC(promptonsecuredesktop)
Drops script or batch files to the startup folder
Found hidden mapped module (file has been removed from disk)
Found malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
JavaScript file contains Antivirus product strings
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Powershell drops PE file
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Drops script at startup location
Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: PowerShell Base64 Encoded IEX Cmdlet
Sigma detected: Remcos
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious PowerShell Parameter Substring
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected DonutLoader
Yara detected Powershell decode and execute
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Yara detected WebBrowserPassView password recovery tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1809759 Sample: Quotation.js Startdate: 07/11/2025 Architecture: WINDOWS Score: 100 154 Suricata IDS alerts for network traffic 2->154 156 Found malware configuration 2->156 158 Malicious sample detected (through community Yara rule) 2->158 160 22 other signatures 2->160 11 cmd.exe 1 2->11         started        14 cmd.exe 2->14         started        16 cmd.exe 2->16         started        18 3 other processes 2->18 process3 file4 162 Suspicious powershell command line found 11->162 164 Wscript starts Powershell (via cmd or directly) 11->164 166 Bypasses PowerShell execution policy 11->166 21 powershell.exe 3 12 11->21         started        23 net.exe 1 11->23         started        31 2 other processes 11->31 25 powershell.exe 14->25         started        33 3 other processes 14->33 27 powershell.exe 16->27         started        35 3 other processes 16->35 128 C:\Users\user\AppData\...\Heliconius.bat, ASCII 18->128 dropped 168 Windows Scripting host queries suspicious COM object (likely to drop second stage) 18->168 170 Suspicious execution chain found 18->170 172 Creates processes via WMI 18->172 29 powershell.exe 18->29         started        37 4 other processes 18->37 signatures5 process6 process7 39 cmd.exe 1 21->39         started        41 net1.exe 1 23->41         started        43 cmd.exe 25->43         started        45 cmd.exe 27->45         started        47 cmd.exe 29->47         started        49 net1.exe 33->49         started        51 conhost.exe 33->51         started        53 net1.exe 35->53         started        55 net1.exe 37->55         started        process8 57 cmd.exe 1 39->57         started        59 net.exe 1 39->59         started        61 conhost.exe 39->61         started        63 cmd.exe 43->63         started        69 2 other processes 43->69 65 cmd.exe 45->65         started        71 3 other processes 45->71 67 cmd.exe 47->67         started        73 2 other processes 47->73 process9 75 cmd.exe 2 57->75         started        78 net1.exe 1 59->78         started        80 cmd.exe 63->80         started        82 cmd.exe 65->82         started        84 cmd.exe 67->84         started        86 net1.exe 69->86         started        88 net1.exe 71->88         started        90 net1.exe 73->90         started        signatures10 174 Suspicious powershell command line found 75->174 176 Wscript starts Powershell (via cmd or directly) 75->176 92 powershell.exe 5 31 75->92         started        97 net.exe 1 75->97         started        99 conhost.exe 75->99         started        101 powershell.exe 80->101         started        107 2 other processes 80->107 103 powershell.exe 82->103         started        109 2 other processes 82->109 105 powershell.exe 84->105         started        111 2 other processes 84->111 process11 dnsIp12 144 91.92.243.7, 1155, 49716, 49717 THEZONEBG Bulgaria 92->144 130 C:\Users\user\AppData\Local\Temp\TH9F7A.tmp, MS-DOS 92->130 dropped 132 C:\Users\user\AppData\Local\Temp\TH9F2A.tmp, MS-DOS 92->132 dropped 134 C:\Users\user\AppData\Local\Temp\TH9F0A.tmp, PE32 92->134 dropped 136 C:\Users\user\AppData\Roaming\...\7640.bat, ASCII 92->136 dropped 178 Detected Remcos RAT 92->178 180 Drops script or batch files to the startup folder 92->180 182 Writes to foreign memory regions 92->182 184 7 other signatures 92->184 113 RmClient.exe 1 92->113         started        116 RmClient.exe 14 92->116         started        118 RmClient.exe 92->118         started        120 net1.exe 1 97->120         started        138 C:\Users\user\AppData\Roaming\...\15a1.bat, ASCII 101->138 dropped 140 C:\Users\user\AppData\Roaming\...\acf8.bat, ASCII 103->140 dropped 142 C:\Users\user\AppData\Roaming\...\40ff.bat, ASCII 105->142 dropped 122 net1.exe 107->122         started        124 net1.exe 109->124         started        126 net1.exe 111->126         started        file13 signatures14 process15 signatures16 146 Tries to steal Instant Messenger accounts or passwords 113->146 148 Tries to steal Mail credentials (via file / registry access) 113->148 150 Tries to steal Mail credentials (via file registry) 116->150 152 Tries to harvest and steal browser information (history, passwords, etc) 116->152
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/30deabad46eac71fa6811b61dd481cd3103a52a6e6911c996d5c61fc2a5ea85f
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/30deabad46eac71fa6811b61dd481cd3103a52a6e6911c996d5c61fc2a5ea85f/
Verdict:
Malicious
Threat:
Family.REMCOS
Link:
https://tip.neiki.dev/file/30deabad46eac71fa6811b61dd481cd3103a52a6e6911c996d5c61fc2a5ea85f
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2025-11-07 03:00:36 UTC
File Type:
Text
AV detection:
8 of 23 (34.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gdpkxlkg5ldr7jubdnq52sa42miduuvg42irzglnlrq7yks6vbpq._file
Verdict:
malicious
Label(s):
donutloader
Create hunting rule
remcos
Create hunting rule
Similar samples:
4ffb945bc637b8c2e1d287c1f6127121d967e1366f0a437f2b7f505fac391f5d
RemcosRAT
6fe0d90ee6b5cdf3e1f8847dba78459deecc3b975a990240e2b9d52a561d695e
RemcosRAT
80943dad82a060b3506f2312c2d282f117e08a1b16cd9f1f6fcaf852be916407
RemcosRAT
cc2204af1024b7fc2c9c7e0132ce788518f3d835741d489886fbab703c08d400
RemcosRAT
d1cfc53e81fdcf625be8284ee7ed47fa1256de5222d2b1d4064524e90724df4e
RemcosRAT
db893d34023865952c4ba57e6e3330c424c828bc6a42c9edb224a48cc53b3a30
RemcosRAT
error
RemcosRAT
febef3a364126ac2aa64f960389c62bd38cc9cfced7606726afe7f0824c239a7
RemcosRAT
+ 172 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
collection defense_evasion discovery execution trojan
Link:
https://tria.ge/reports/251107-hv25ssar2x/
Behaviour
Runs net.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: JavaScript
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Command and Scripting Interpreter: PowerShell
Drops startup file
Badlisted process makes network request
Detected Nirsoft tools
NirSoft MailPassView
NirSoft WebBrowserPassView
Process spawned unexpected child process
UAC bypass
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/30deabad46ea/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.20
Link:
https://yomi.yoroi.company/submissions/30deabad46eac71fa6811b61dd481cd3103a52a6e6911c996d5c61fc2a5ea85f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_EXE_Packed_MPress
Create hunting rule
Author:ditekSHen
Description:Detects executables built or packed with MPress PE compressor
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Author:ditekSHen
Description:Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:Remcos_unpacked_PulseIntel
Create hunting rule
Author:PulseIntel
Description:Remcos Payload
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:TeslaCryptPackedMalware
Create hunting rule
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Windows_Trojan_Remcos_b296e965
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.remcos.
Rule name:win_remcos_rat_unpacked
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in remcos rat Samples.
Rule name:win_remcos_w0
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in remcos rat Samples.
Rule name:yarahub_win_remcos_rat_unpacked_aug_2023
Create hunting rule
Author:Matthew @ Embee_Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Java Script (JS) js 30deabad46eac71fa6811b61dd481cd3103a52a6e6911c996d5c61fc2a5ea85f

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments