MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 32aa0546c952a980435c113eeb04b6f9a82bf2b260e0b7b261010eaa585d55f1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 19

Intelligence 19 IOCs 1 YARA 22 File information Comments

SHA256 hash:	32aa0546c952a980435c113eeb04b6f9a82bf2b260e0b7b261010eaa585d55f1
SHA3-384 hash:	17a1ce1a9d8f3ddf9dedabc23e3279dd4e44094cb2ff2f0f04dc3730a1b2d45f7d537bf7709772d9a354355254196369
SHA1 hash:	6bf2f0e04b6eafe0288fb1714453ff425d15bb01
MD5 hash:	444e44405256c9407768493004b8a7e4
humanhash:	jersey-mockingbird-fish-ink
File name:	Shipping Documents.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	1'572'864 bytes
First seen:	2025-10-17 11:40:09 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f221a2d3033e0539dac1a47c2d35a7fd (3 x a310Logger, 2 x DarkCloud, 1 x RemcosRAT)
ssdeep	24576:Uqc9xpX0zhQ87kVzzMkQTtlzt4edMsxY+xnYz7DqY1Z2XrLd+ZfDrh:UbKmDtkpr4emqxYz7BC3d+Zb
Threatray	4'098 similar samples on MalwareBazaar
TLSH	T1F975D025E2D2893BD3270579CC2BD6D258197B212F287A5E76CDDB087FFD2C22C16192
TrID	35.4% (.EXE) Win64 Executable (generic) (10522/11/4) 22.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 15.1% (.EXE) Win32 Executable (generic) (4504/4/1) 6.9% (.EXE) Win16/32 Executable Delphi generic (2072/23) 6.8% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	abuse_ch
Tags:	exe RAT RemcosRAT

abuse_ch

RemcosRAT C2:
172.245.246.89:2404

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
172.245.246.89:2404	https://threatfox.abuse.ch/ioc/1617275/

Intelligence

File Origin

# of uploads :

# of downloads :

125

Origin country :

Vendor Threat Intelligence

Malware family:

remcos

ID:

File name:

_32aa0546c952a980435c113eeb04b6f9a82bf2b260e0b7b261010eaa585d55f1.exe

Verdict:

Malicious activity

Analysis date:

2025-10-17 11:46:26 UTC

Tags:

delphi rat remcos

Link:

https://app.any.run/tasks/02b8aaa5-1390-463f-ae97-f70c875f0c0c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/33196/

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68f22b3f0cffb3244298c555

Tags:

delphi emotet

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a window

Launching a process

Creating a file

DNS request

Connection attempt

Sending a custom TCP request

Sending an HTTP GET request

Reading critical registry keys

Creating a file in the %temp% directory

Launching a service

Stealing user critical data

Unauthorized injection to a system process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug borland_delphi fingerprint keylogger masquerade overlay packed zero

Link:

https://www.filescan.io/uploads/68f22b30df5cb32bf1f0faf6/reports/ebaaac00-30c2-4400-8108-a05258e739b3/overview

Verdict:

Malicious

Labled as:

TrojanDownloader.ModiLoader

Link:

https://www.hybrid-analysis.com/sample/32aa0546c952a980435c113eeb04b6f9a82bf2b260e0b7b261010eaa585d55f1

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-10-17T07:44:00Z UTC

Last seen:

2025-10-19T09:40:00Z UTC

Hits:

~1000

Detections:

PDM:Trojan.Win32.Generic Trojan.Win32.Shellcode.sb HEUR:Trojan.Win32.Injects.gen

Link:

https://opentip.kaspersky.com/32aa0546c952a980435c113eeb04b6f9a82bf2b260e0b7b261010eaa585d55f1/results?tab=lookup

Malware family:

ModiLoader

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/7c8204ff-1004-4127-a5a9-cc43752c88fb

Result

Threat name:

Remcos, DBatLoader

Detection:

malicious

Classification:

phis.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1797107

Signature

Allocates many large memory junks

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Detected Remcos RAT

Early bird code injection technique detected

Found malware configuration

Initial sample is a PE file and has a suspicious name

Installs a global keyboard hook

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for submitted file

Queues an APC in another process (thread injection)

Sigma detected: Remcos

Suricata IDS alerts for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected DBatLoader

Yara detected Remcos RAT

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/32aa0546c952a980435c113eeb04b6f9a82bf2b260e0b7b261010eaa585d55f1

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/444e44405256c9407768493004b8a7e4

Detection:

remcos

Link:

https://mwdb.cert.pl/sample/32aa0546c952a980435c113eeb04b6f9a82bf2b260e0b7b261010eaa585d55f1/

Verdict:

Malicious

Threat:

Family.REMCOS

Link:

https://tip.neiki.dev/file/32aa0546c952a980435c113eeb04b6f9a82bf2b260e0b7b261010eaa585d55f1

Threat name:

Win32.Trojan.Znyonm

Status:

Malicious

First seen:

2025-10-17 11:40:45 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

18 of 24 (75.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gkvakrwjkkuyaq24ce7owbfw7gucx4vsmdqlpmtbaehkuwc5kxyq._file

Verdict:

malicious

Label(s):

remcos

dbatloader

donut_injector

Result

Malware family:

modiloader

Score:

10/10

Tags:

family:modiloader collection discovery trojan

Link:

https://tria.ge/reports/251017-ns76xs1ny6/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook accounts

ModiLoader Second Stage

ModiLoader, DBatLoader

Modiloader family

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/d2b4f704-b05e-45be-a370-c989bbea9a79

Unpacked files

SH256 hash:

32aa0546c952a980435c113eeb04b6f9a82bf2b260e0b7b261010eaa585d55f1

MD5 hash:

444e44405256c9407768493004b8a7e4

SHA1 hash:

6bf2f0e04b6eafe0288fb1714453ff425d15bb01

Link:

https://www.unpac.me/results/55c467b6-b2c4-4809-b056-158c131776b1/

Malware family:

Remcos

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/32aa0546c952/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/32aa0546c952a980435c113eeb04b6f9a82bf2b260e0b7b261010eaa585d55f1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BobSoftMiniDelphiBoBBobSoft Create hunting rule
Author:	malware-lu

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	iexplorer_remcos Create hunting rule
Author:	iam-py-test
Description:	Detect iexplorer being taken over by Remcos

Rule name:	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer Create hunting rule
Author:	ditekSHen
Description:	detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Remcos Create hunting rule
Author:	kevoreilly
Description:	Remcos Payload

Rule name:	REMCOS_RAT_variants Create hunting rule

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Windows_Trojan_Remcos_b296e965 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.remcos.

Rule name:	win_remcos_rat_unpacked Create hunting rule
Author:	Matthew @ Embee_Research
Description:	Detects strings present in remcos rat Samples.

Rule name:	win_remcos_w0 Create hunting rule
Author:	Matthew @ Embee_Research
Description:	Detects strings present in remcos rat Samples.

Rule name:	yarahub_win_remcos_rat_unpacked_aug_2023 Create hunting rule
Author:	Matthew @ Embee_Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/33196/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample