MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 419dcf04a8eb8455ea63458338d802c98522f70d2d04cf218d6fcbd2e5d87ba8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RemcosRAT
Vendor detections: 9
| SHA256 hash: | 419dcf04a8eb8455ea63458338d802c98522f70d2d04cf218d6fcbd2e5d87ba8 |
|---|---|
| SHA3-384 hash: | e242d5fb2b4a4b9546cac2965a51e8210dd2dffd6a44deb06bef596002b3bb46644e89f21d589e63d64e5c05fd9447df |
| SHA1 hash: | be4e1ac566ef059cea7ae2a392b0c63281a8603a |
| MD5 hash: | ce1cd20b51114f5ad3f19633f8178792 |
| humanhash: | maryland-indigo-nevada-beryllium |
| File name: | _DOCUMENT_MAIL_MK77123.PDF.js |
| Download: | download sample |
| Signature | RemcosRAT |
| File size: | 86'880 bytes |
| First seen: | 2025-02-22 23:19:29 UTC |
| Last seen: | 2026-05-20 17:35:52 UTC |
| File type: |  js |
| MIME type: | text/plain |
| ssdeep | 384:HZB5abqZB5abtZB5abdZB5abzZB5abtZB5abdZB5ab7ZB5abtZB5abdZB5abWZBw:G |
| TLSH | T12683A00CD017D7DAF8AA51AC3D61FE4D8A0C4E4EB995C31C3B1CB2861B2AFF5A566C44 |
| Magika | javascript |
| Reporter |  TomU |
| Tags: | 176.65.141.238 js meme-ZPFPWZ meme7.work.gd remcos RemcosRAT |
TomU
85f079d42497f232431cf179530b6614d0409b2e7424b9442a9d2f41218bd150 _DOCUMENT_MAIL_MK77123.PDF.gz419dcf04a8eb8455ea63458338d802c98522f70d2d04cf218d6fcbd2e5d87ba8 _DOCUMENT_MAIL_MK77123.PDF.js
hXXps://paste[.]ee/d/85AJMNma
690b31fd790e1c47724b42c4440c8b729f0ddaa80150bd7cf631f913638c77f9 paste.ee_d_85AJMNma.js
5ceb49490880a023c8b3866153741a9036d7907c49b4aecb331cb9c0f251bdfe paste.ee_d_85AJMNma_decoded_PS.cmd
hXXps://3005.filemail[.]com/api/file/get?filekey=nIx_5T0LxHOBjilNb9CRviabPjrW2dlC-LxeOdJPF_Z_1MP6CuQBS5KcptA&pk_vid=342803d1cc4e3b801739359203b5fe9d
https://www.virustotal.com/gui/url/1fe27980841066c272c061a618dcfdbf7f083ee8216c08e98ec2c40d78ea27ba
https://www.virustotal.com/gui/file/ef4472cf2616798f6d8726e148d68974a7edb830f622d130f58fcdf0837147b1
hXXps://stakloram[.]rs/css/ym.txt
0a75498800959210a5e2dc4e4a54ef8f97997861d794a065114c5234e6d4ed86 stakloram.rs_css_ym.txt
https://www.virustotal.com/gui/file/0a75498800959210a5e2dc4e4a54ef8f97997861d794a065114c5234e6d4ed86
https://www.virustotal.com/gui/file/f828561f75ee664450e1aac29256aa0aff6bd349232f98d33048dde78c0962bf
Remcos RAT C2: meme7.work[.]gd:3124 / 176.65.141[.]238 (Mutex: meme-ZPFPWZ)
Intelligence
File Origin
# of uploads :
2
# of downloads :
401
Origin country :
CHVendor Threat Intelligence
Detection(s):
Verdict:
Malicious
Score:
93.3%
Tags:
virus spawn
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
masquerade obfuscated
Verdict:
Malicious
Labled as:
Trojan[Downloader]/Script.SLoad
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Signature
Connects to a pastebin service (likely for C&C)
Found suspicious powershell code related to unpacking or dynamic code loading
JScript performs obfuscated calls to suspicious functions
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample has a suspicious name (potential lure to open the executable)
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Powershell download and load assembly
Sigma detected: Script Initiated Connection to Non-Local Network
Sigma detected: Suspicious Parent Double Extension File Execution
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
System process connects to network (likely due to code injection or exploit)
Uses an obfuscated file name to hide its real file extension (double extension)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Threat name:
Script.Trojan.Heuristic
Status:
Malicious
First seen:
2025-02-21 07:45:12 UTC
AV detection:
6 of 24 (25.00%)
Threat level:
2/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
10/10
Tags:
execution
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
Command and Scripting Interpreter: PowerShell
Checks computer location settings
Blocklisted process makes network request
Malware Config
Dropper Extraction:
https://3005.filemail.com/api/file/get?filekey=nIx_5T0LxHOBjilNb9CRviabPjrW2dlC-LxeOdJPF_Z_1MP6CuQBS5KcptA&pk_vid=342803d1cc4e3b801739359203b5fe9d
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.