🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 329d8980bb4ef76aa39696076ea0f0c4997d91c51d702a4eec546c956fa46715. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 16


Intelligence 16 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 329d8980bb4ef76aa39696076ea0f0c4997d91c51d702a4eec546c956fa46715
SHA3-384 hash: 996fe5902703c10746ceee0f63e96bbe772d63d321b8efe036281e4f2dd9c99382a100477a7ac81bf74110d194893577
SHA1 hash: d89fa03dcc3b9b0217bd1d3d216cea7f23f12b07
MD5 hash: 218b1d87e59399ecb0d25f355f8f0cea
humanhash: solar-hot-river-wisconsin
File name:scan102625.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:456'880 bytes
First seen:2025-10-27 09:24:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e2a592076b17ef8bfb48b7e03965a3fc (419 x GuLoader, 63 x RemcosRAT, 52 x AgentTesla)
ssdeep 12288:acE8OLszQv6BHpmZWMeRXXll3SEr11i7NBC1FsXq8d6f:at8/zU6BGWRJ18Er1sNB0saT
TLSH T1E2A412402530C5AADCA20676C9742BFF1A6AFD1EF656AB070B19FF173C712C96B0C295
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10522/11/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter lowmal3
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
123
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
remcos
Create hunting rule
ID:
1
File name:
scan102625.exe
Verdict:
Malicious activity
Analysis date:
2025-10-27 09:28:32 UTC
Tags:
remcos rat auto-reg remote stealer mpress
Link:
https://app.any.run/tasks/c7e467ca-d890-46f4-a02e-4a442b42dc48

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/34260/
Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68ff3a616c859164aa652c60
Tags:
injection obfusc
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Creating a file in the %temp% subdirectories
Creating a file
Delayed reading of the file
DNS request
Connection attempt
Unauthorized injection to a recently created process
Restart of the analyzed sample
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
adaptive-context installer microsoft_visual_cc obfuscated overlay signed
Link:
https://www.filescan.io/uploads/68ff3a5d3a79800405f843e0/reports/c568e6da-b94f-4b20-801b-b99bfbd04045/overview
Verdict:
Malicious
Labled as:
Injector.BXG.gen
Link:
https://www.hybrid-analysis.com/sample/329d8980bb4ef76aa39696076ea0f0c4997d91c51d702a4eec546c956fa46715
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-10-26T22:30:00Z UTC
Last seen:
2025-10-29T07:09:00Z UTC
Hits:
~1000
Detections:
Trojan.NSIS.Makoob.sba VHO:Trojan.NSIS.Makoob.gen VHO:Backdoor.Win32.Remcos.gen Trojan-Downloader.Win32.Minix.sb HEUR:Trojan.Win32.Makoob.gen Trojan.NSIS.Makoob.sbe
Link:
https://opentip.kaspersky.com/329d8980bb4ef76aa39696076ea0f0c4997d91c51d702a4eec546c956fa46715/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/6a777efa-8b11-4dbe-b257-7048782bc14a
Result
Threat name:
GuLoader, Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.evad.phis.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1802269
Signature
AI detected suspicious PE digital signature
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Creates autostart registry keys with suspicious names
Detected Remcos RAT
Found direct / indirect Syscall (likely to bypass EDR)
Found hidden mapped module (file has been removed from disk)
Found malware configuration
Joe Sandbox ML detected suspicious sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Writes to foreign memory regions
Yara detected GuLoader
Yara detected Remcos RAT
Yara detected WebBrowserPassView password recovery tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1802269 Sample: scan102625.exe Startdate: 27/10/2025 Architecture: WINDOWS Score: 100 67 drive.usercontent.google.com 2->67 69 drive.google.com 2->69 75 Suricata IDS alerts for network traffic 2->75 77 Found malware configuration 2->77 79 Antivirus detection for dropped file 2->79 81 9 other signatures 2->81 10 scan102625.exe 1 31 2->10         started        14 remcos.exe 2->14         started        16 remcos.exe 25 2->16         started        18 rundll32.exe 2->18         started        signatures3 process4 file5 57 C:\Users\user\AppData\Local\...\System.dll, PE32 10->57 dropped 103 Tries to detect virtualization through RDTSC time measurements 10->103 105 Switches to a custom stack to bypass stack traces 10->105 107 Found direct / indirect Syscall (likely to bypass EDR) 10->107 20 scan102625.exe 2 10 10->20         started        59 C:\Users\user\AppData\Local\...\System.dll, PE32 14->59 dropped 25 remcos.exe 14->25         started        61 C:\Users\user\AppData\Local\...\System.dll, PE32 16->61 dropped 27 remcos.exe 16->27         started        signatures6 process7 dnsIp8 71 drive.google.com 142.250.176.206, 443, 49766, 49768 GOOGLEUS United States 20->71 73 drive.usercontent.google.com 142.251.35.161, 443, 49767, 49769 GOOGLEUS United States 20->73 53 C:\ProgramData\Remcos\remcos.exe, PE32 20->53 dropped 55 C:\ProgramData\...\remcos.exe:Zone.Identifier, ASCII 20->55 dropped 89 Detected Remcos RAT 20->89 91 Creates autostart registry keys with suspicious names 20->91 29 remcos.exe 25 20->29         started        93 Found direct / indirect Syscall (likely to bypass EDR) 25->93 file9 signatures10 process11 file12 63 C:\Users\user\AppData\Local\...\System.dll, PE32 29->63 dropped 109 Multi AV Scanner detection for dropped file 29->109 111 Found hidden mapped module (file has been removed from disk) 29->111 113 Tries to detect virtualization through RDTSC time measurements 29->113 115 Switches to a custom stack to bypass stack traces 29->115 33 remcos.exe 4 10 29->33         started        signatures13 process14 dnsIp15 65 196.251.72.93, 2404, 49770, 49771 Web4AfricaZA Seychelles 33->65 47 C:\Users\user\AppData\Local\Temp\TH5C16.tmp, MS-DOS 33->47 dropped 49 C:\Users\user\AppData\Local\Temp\TH5BF6.tmp, MS-DOS 33->49 dropped 51 C:\Users\user\AppData\Local\Temp\TH5B97.tmp, PE32 33->51 dropped 83 Detected Remcos RAT 33->83 85 Writes to foreign memory regions 33->85 87 Maps a DLL or memory area into another process 33->87 38 RmClient.exe 33->38         started        41 RmClient.exe 33->41         started        43 RmClient.exe 2 33->43         started        45 RmClient.exe 33->45         started        file16 signatures17 process18 signatures19 95 Tries to steal Instant Messenger accounts or passwords 38->95 97 Tries to steal Mail credentials (via file / registry access) 38->97 99 Tries to harvest and steal browser information (history, passwords, etc) 41->99 101 Tries to steal Mail credentials (via file registry) 45->101
Score:
73%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/329d8980bb4ef76aa39696076ea0f0c4997d91c51d702a4eec546c956fa46715
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable NSIS Installer PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/218b1d87e59399ecb0d25f355f8f0cea
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/329d8980bb4ef76aa39696076ea0f0c4997d91c51d702a4eec546c956fa46715/
Verdict:
Malicious
Threat:
Family.REMCOS
Link:
https://tip.neiki.dev/file/329d8980bb4ef76aa39696076ea0f0c4997d91c51d702a4eec546c956fa46715
Threat name:
Win32.Malware.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-10-27 01:44:46 UTC
AV detection:
3 of 38 (7.89%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gkoytaf3j33wvi4wsydw5ihqysmx3eofdvycutxmkrwjk35em4kq._file
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:guloader family:remcos botnet:remotehost collection discovery downloader persistence rat
Link:
https://tria.ge/reports/251027-ldb4tscq5v/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Windows directory
Launches sc.exe
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Detected Nirsoft tools
NirSoft MailPassView
NirSoft WebBrowserPassView
Guloader family
Guloader,Cloudeye
Remcos
Remcos family
Malware Config
C2 Extraction:
196.251.72.93:2404
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/599368ab-c872-4210-bcb2-a03d7af80fd0
Unpacked files
SH256 hash:
329d8980bb4ef76aa39696076ea0f0c4997d91c51d702a4eec546c956fa46715
MD5 hash:
218b1d87e59399ecb0d25f355f8f0cea
SHA1 hash:
d89fa03dcc3b9b0217bd1d3d216cea7f23f12b07
Link:
https://www.unpac.me/results/2f166bbc-bf86-41cd-afec-1c43ec7ea2d3/
SH256 hash:
bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
MD5 hash:
17ed1c86bd67e78ade4712be48a7d2bd
SHA1 hash:
1cc9fe86d6d6030b4dae45ecddce5907991c01a0
Link:
https://www.unpac.me/results/2f166bbc-bf86-41cd-afec-1c43ec7ea2d3/
SH256 hash:
c13104552b8b553159f50f6e2ca45114493397a6fa4bf2cbb960c4a2bbd349ab
MD5 hash:
42b064366f780c1f298fa3cb3aeae260
SHA1 hash:
5b0349db73c43f35227b252b9aa6555f5ede9015
Link:
https://www.unpac.me/results/2f166bbc-bf86-41cd-afec-1c43ec7ea2d3/
Malware family:
GuLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/329d8980bb4e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.52
Link:
https://yomi.yoroi.company/submissions/329d8980bb4ef76aa39696076ea0f0c4997d91c51d702a4eec546c956fa46715

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Executable exe 329d8980bb4ef76aa39696076ea0f0c4997d91c51d702a4eec546c956fa46715

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/34260/

Comments