MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3c594b6652de9bcb3f072008dbff1f4c35c56270acb65574f01ded9bed95bbbe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	3c594b6652de9bcb3f072008dbff1f4c35c56270acb65574f01ded9bed95bbbe
SHA3-384 hash:	1ec02d3ab821a3acf97d8384158f249b598b6d17b6342329998699970120a86edb4bdd246dd756d7752ad5962cd5bdd7
SHA1 hash:	bb88896e1ce8af2116071ae1c2eeaca8787f46c8
MD5 hash:	78bb6c75b2e57e3ae84acdf8bff8f862
humanhash:	mountain-island-tango-undress
File name:	$33,456 sport swest-Payment-Reimbursement.zip
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	27'456 bytes
First seen:	2026-03-18 12:45:27 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	768:DNVrIL+Kpgh2Xcfa7S7tDLJetBa6g6X6y6q:TULmh2kzt/0ba6H6zq
TLSH	T123C2D0EB426F18321FF619127306F8A67992E0BF454D5FE791863793869C038B8A1377
Magika	zip
Reporter	proxylife
Tags:	RemcosRAT zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

52

Origin country :

US

Vendor Threat Intelligence

ACCE Zip_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/0536d78f-02b2-4a73-b66a-99fc8e13a169/

ClamAV Detected

Detection(s):

SecuriteInfo.com.BAT.Obfus-4.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69ba9e9988c80c01586ba241

Tags:

n/a

DocGuard Clean

Result

Verdict:

Clean

File Type:

Generic File

Link:

https://app.docguard.net/3c594b6652de9bcb3f072008dbff1f4c35c56270acb65574f01ded9bed95bbbe/results/dashboard

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/69ba9e962000fc76c3e963f2/reports/8f9e77bf-0d24-4f08-82df-6eec2d76f9a6/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/3c594b6652de9bcb3f072008dbff1f4c35c56270acb65574f01ded9bed95bbbe

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Link:

https://labs.inquest.net/dfi/sha256/3c594b6652de9bcb3f072008dbff1f4c35c56270acb65574f01ded9bed95bbbe

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

zip

Link:

https://opentip.kaspersky.com/3c594b6652de9bcb3f072008dbff1f4c35c56270acb65574f01ded9bed95bbbe/results?tab=lookup

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ARCHIVE

Link:

https://malprob.io/report/3c594b6652de9bcb3f072008dbff1f4c35c56270acb65574f01ded9bed95bbbe

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3c594b6652de9bcb3f072008dbff1f4c35c56270acb65574f01ded9bed95bbbe/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hrmuwzss32n4wpyheaenx7y7jq24kytqvs3fk5hqdxwzx3mvxo7a._file

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:donutloader family:remcos botnet:remoteconnect collection credential_access discovery execution loader rat stealer

Link:

https://tria.ge/reports/260318-p9vslah17z/

Behaviour

Enumerates system info in registry

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

System Time Discovery

Drops file in Program Files directory

Drops file in Windows directory

Suspicious use of SetThreadContext

Accesses Microsoft Outlook accounts

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Uses browser remote debugging

Detected Nirsoft tools

NirSoft MailPassView

NirSoft WebBrowserPassView

Detects DonutLoader

DonutLoader

Donutloader family

Remcos

Remcos family

Malware Config

C2 Extraction:

www.msftocumicerqssoftt.top:2404
www.msftocumicerqssofttbackup3.top:2404
www.msftocumicerqssofttbackup1.com:2404
www.msftocumicerqssofttbackup2.com:2404

Dropper Extraction:

https://filedn.com/lEr8X39QyI3Ff9hN9vGodiR/7z.exe
https://filedn.com/lEr8X39QyI3Ff9hN9vGodiR/7z.dll
https://shatrujeetpublicschool.com/Document/BFXUUAULRFWMGXCZJHASIGZWPXNQGYJDWXATLBWYKDVJXNTOHRUQSTWVRLYTJSCWL.zip

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.08

Link:

https://yomi.yoroi.company/submissions/3c594b6652de9bcb3f072008dbff1f4c35c56270acb65574f01ded9bed95bbbe