MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3745a4fc21cdde77dde67e22f54a7cbd7b761e1b05644a1e93ec2551209ecf1d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	3745a4fc21cdde77dde67e22f54a7cbd7b761e1b05644a1e93ec2551209ecf1d
SHA3-384 hash:	e6bf2789f10711807fcb09a78a1518d8e6de5f6cfe3e1017e59baae79ab5d5631f82195659f4d70b66b28d12d7ab87dc
SHA1 hash:	c02f27b7c7bb546476a165a716f9e5b0ef274570
MD5 hash:	91c3a5e3842521b6957ce7db490da3af
humanhash:	kansas-bluebird-eleven-island
File name:	35.480,25 EUR Ödeme Dekontu.js
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	1'281'582 bytes
First seen:	2026-07-27 09:45:09 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	3072:YDUaFIG/cWVUtpe5iVxoDCieuUdEOsiKdIDG5FqKA3oMxoEbV7sOK5YfC7uJYjpD:+
TLSH	T12D55D77DCC29823EC2B7C629CAC78A07F95A1817321CFD4AA4D3735B9127193B4E256D
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	txt
Reporter	lowmal3
Tags:	js RemcosRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

134

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

aes base64 base64 cmd conhost crypto encrypted lolbin obfuscated overlay powershell repaired

Link:

https://www.filescan.io/uploads/6a6728d0fd0eb33ef0685182/reports/ae6e4828-98e8-4f60-9bfc-68d7baae1230/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/3745a4fc21cdde77dde67e22f54a7cbd7b761e1b05644a1e93ec2551209ecf1d

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-07-27T03:02:00Z UTC

Last seen:

2026-07-27T06:44:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/3745a4fc21cdde77dde67e22f54a7cbd7b761e1b05644a1e93ec2551209ecf1d/results?tab=lookup

Joe Sandbox Remcos

Result

Threat name:

Remcos

Alert

Create hunting rule

Detection:

malicious

Classification:

rans.troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1948253

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to bypass UAC (CMSTPLUA)

Contains functionality to register a low level keyboard hook

Contains functionality to steal Internet Explorer form passwords

Contains functionalty to change the wallpaper

Creates an undocumented autostart registry key

Detected Remcos RAT

Found malware configuration

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Sigma detected: Remcos

Sigma detected: WScript or CScript Dropper

Suspicious command line found

Suspicious execution chain found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file registry)

Unusual module load detection (module proxying)

Uses dynamic DNS services

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

WScript reads language and country specific registry keys (likely country aware script)

Yara detected Powershell decode and execute

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

85%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/3745a4fc21cdde77dde67e22f54a7cbd7b761e1b05644a1e93ec2551209ecf1d

Malva.RE

Gathering data

CERT.PL MWDB remcos

Detection:

remcos

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/3745a4fc21cdde77dde67e22f54a7cbd7b761e1b05644a1e93ec2551209ecf1d/

ReversingLabs TitaniumCloud

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=g5c2j7bbzxphpxpgpyrpkst4xv5xmhq3avseuhut5qsvcie6z4oq._file

Threatray Remcos

Verdict:

malicious

Label(s):

Remcos

Alert

Create hunting rule

Link:

https://reports.threatray.com/322ecfcf-0f73-4de2-9841-8cf66389ad26

Similar samples:

2eabe71b18863d2044945eb371da1dbd5d12bc973538755b6177a235712db361

RemcosRAT

7550b52651ebd31c33a77f798b07c7365827ca759adfe8092de83683b27ef198

RemcosRAT

aff8f851155a1e45b120dfcf0ccd0ff9679ee0d3ae4284b09d01c88ff46b48bb

RemcosRAT

d33f6bd48d7a46fa09cebad6a43f82615451d5243c143a7da6aeaebfc24aec64

RemcosRAT

ed1427c973e2c1fecdf2536e270fec2af98e31e229fbdae6664b0e23af321f9a

RemcosRAT

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos botnet:client collection discovery execution persistence rat

Link:

https://tria.ge/reports/260727-lrhtjacn7v/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

outlook_office_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Executes a command shell one-liner

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Checks computer location settings

Registers new Windows logon scripts automatically executed at logon.

Badlisted process makes network request

Downloads MZ/PE file

Family: Remcos

Malware Config

C2 Extraction:

papilawdns.duckdns.org:2404

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3745a4fc21cdde77dde67e22f54a7cbd7b761e1b05644a1e93ec2551209ecf1d