MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3e5dc24c78b7e9adf091d621235f04be8b83a31cdcbe635865c4f6453c4b59b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 18


Intelligence 18 IOCs YARA 23 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3e5dc24c78b7e9adf091d621235f04be8b83a31cdcbe635865c4f6453c4b59b9
SHA3-384 hash: 69961234d9cf3a0e4dac5aa6072db2e9a2ceaac16b578e067088697767fc35ee4d92561bf66293b623cefbc230619f56
SHA1 hash: 374b3ed87aa362d55f077ac7f5f820720037d22e
MD5 hash: a519f4947900841cbd81824d3dbad42e
humanhash: iowa-friend-video-maryland
File name:3e5dc24c78b7e9adf091d621235f04be8b83a31cdcbe635865c4f6453c4b59b9
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'337'344 bytes
First seen:2025-09-05 13:22:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1895460fffad9475fda0c84755ecfee1 (308 x Formbook, 52 x AgentTesla, 36 x SnakeKeylogger)
ssdeep 24576:F5EmXFtKaL4/oFe5T9yyXYfP1ijXdaB20IZVn5oR2B8VfB844cS:FPVt/LZeJbInQRaB2hLn5EH1
Threatray 4'128 similar samples on MalwareBazaar
TLSH T15E55CF0273C1C066FFAB91334F5AF6115BBC79260123A61F13A81DB9BA705B1563E7A3
TrID 40.3% (.EXE) Win64 Executable (generic) (10522/11/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter adrian__luca
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
http://198.55.98.232/DOGF5TOP09877800090000000.tar
Verdict:
Malicious activity
Analysis date:
2025-08-26 10:31:37 UTC
Tags:
arch-exec
Link:
https://app.any.run/tasks/95a09601-dbd6-4152-b786-6287e34372c2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/25700/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68bae4a3eb163e0ec18487ac
Tags:
autorun autoit emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Creating a file
Creating a process from a recently created file
Launching a process
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Sending a custom TCP request
Connection attempt to an infection source
Sending a TCP request to an infection source
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context autoit compiled-script fingerprint keylogger microsoft_visual_cc obfuscated packed packed packer_detected threat
Link:
https://www.filescan.io/uploads/68baf6b620d0ee406d96cce8/reports/18766426-94c7-4be7-9896-ba92814e050b/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/3e5dc24c78b7e9adf091d621235f04be8b83a31cdcbe635865c4f6453c4b59b9
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-08-26T06:04:00Z UTC
Last seen:
2025-08-26T06:04:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/3e5dc24c78b7e9adf091d621235f04be8b83a31cdcbe635865c4f6453c4b59b9/results?tab=lookup
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7f06a9a1-cb55-463d-9032-7488328388c6
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/3e5dc24c78b7e9adf091d621235f04be8b83a31cdcbe635865c4f6453c4b59b9
Verdict:
Malware
YARA:
7 match(es)
Tags:
AutoIt Decompiled Executable PDB Path PE (Portable Executable) PE File Layout Suspect Win 32 Exe x86
Link:
https://app.malva.re/file/a519f4947900841cbd81824d3dbad42e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3e5dc24c78b7e9adf091d621235f04be8b83a31cdcbe635865c4f6453c4b59b9/
Threat name:
Win32.Trojan.AutoitInject
Create hunting rule
Status:
Malicious
First seen:
2025-08-26 09:08:58 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hzo4etdyw7u234er2yqsgxyex2fyhiy43s7ggwdfyt3ekpcllg4q._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
09ed77b7dcd2dcff435a3c045a419e82671ee6e4cefb1a988e52f4266ee970cb
RemcosRAT
32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153
RemcosRAT
6981d8702172dc39f302bdeb4917c0eb49f7c37b2a90bee41f64ccecc7e9497d
RemcosRAT
7422bc2c77e70c2e90c27d030a13eb3adf0bcfc1ef2bc55b62871181af5cd955
RemcosRAT
7f418aa89e1a6200adcfe264ec8428f7e45e3c381ca37206cb147abdd0e80a68
RemcosRAT
ae016e4375fd5a26f3a6694090d6d4acdef0ad2e1a6b655245edaba423326207
RemcosRAT
d3b62483fbf63ecc9b1813d77f80591d6cf00892eb030486475b6634c6c2ab0b
RemcosRAT
e2a2ef424d46551a299d19bdbd51297b926bb7bcbc933770841b6f712f3995dd
RemcosRAT
fc5a104616191074e73ca74e64056c26e129b75395e57257eebf629772200d21
RemcosRAT
+ 4'118 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost discovery rat
Link:
https://tria.ge/reports/250905-rzh26abr9z/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
System Location Discovery: System Language Discovery
AutoIT Executable
Suspicious use of SetThreadContext
Drops startup file
Executes dropped EXE
Remcos
Remcos family
Malware Config
C2 Extraction:
198.12.126.169:8787
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/2215203d-f42a-4d2a-889f-aaac81d18c6c
Unpacked files
SH256 hash:
3e5dc24c78b7e9adf091d621235f04be8b83a31cdcbe635865c4f6453c4b59b9
MD5 hash:
a519f4947900841cbd81824d3dbad42e
SHA1 hash:
374b3ed87aa362d55f077ac7f5f820720037d22e
Link:
https://www.unpac.me/results/f2232e1c-e889-40ad-aecb-f06504be7140/
SH256 hash:
545671e66fb4496793dc4b1fc5af753c615c6c9fef295a6338d01065b0666876
MD5 hash:
f4ce70b4579d006922c48752b7857afb
SHA1 hash:
bb2547d905dbad0987054de67b48c53e9ef987c4
Detections:
win_remcos_w0
Create hunting rule
win_remcos_auto
Create hunting rule
Remcos
Create hunting rule
malware_windows_remcos_rat
Create hunting rule
win_remcos_rat_unpacked
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Link:
https://www.unpac.me/results/f2232e1c-e889-40ad-aecb-f06504be7140/
Parent samples :
0ce45ef5e6b470b80e4c7079377953db80ecfc5393fb76ee4568fa334c613924
ed17eb2e83fcca67ba66de21c6357ed58d2c684793aa0e7364e120c189488a6e
b8d9098cd559f1cad2b5822c4f41a0e1d105878a95650967539014826a856220
a4469de201ddfb4d5102a3cfeb04974284a9469074ebe6e4859baead0685154a
3e5dc24c78b7e9adf091d621235f04be8b83a31cdcbe635865c4f6453c4b59b9
89294d5c1a033154e10fd604877db9a4b80f48bde81b1c72639fe36fbf0c224a
5376f3fdc59befa0e3af575beb1ca43180a9edceae0a26eba338aa2b1ca37953
4692619ce40d97bef76e23478bb66e119fef350b7ca0024163fdb335b91420fa
e16e382a86bb0930cf4dfa72fea34e7f65948d9ebf669b8282fd9405aea737d5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Remcos
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/3e5dc24c78b7e9adf091d621235f04be8b83a31cdcbe635865c4f6453c4b59b9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:iexplorer_remcos
Create hunting rule
Author:iam-py-test
Description:Detect iexplorer being taken over by Remcos
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:remcos_
Create hunting rule
Author:Michelle Khalil
Description:This rule detects unpacked remcos malware samples.
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Windows_Trojan_Remcos_b296e965
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.remcos.
Rule name:win_remcos_rat_unpacked
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in remcos rat Samples.
Rule name:win_remcos_w0
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in remcos rat Samples.
Rule name:yarahub_win_remcos_rat_unpacked_aug_2023
Create hunting rule
Author:Matthew @ Embee_Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/25700/

Comments