MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 4235c4b9a9b9da916671b5efcd96a137de5a20e203aebfb78feb11d2bf03069e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RemcosRAT
Vendor detections: 12
| SHA256 hash: | 4235c4b9a9b9da916671b5efcd96a137de5a20e203aebfb78feb11d2bf03069e |
|---|---|
| SHA3-384 hash: | be66d8733a04afde7096759453abdbe053bdcd1ba0d872c917d663376d2ee89852d88f35b2d2edf55edd5925b8a377df |
| SHA1 hash: | 526944801efe4d6c9b74f3e26c2281ef46f3aaac |
| MD5 hash: | 7a489d2ae7f5e819921dc44b2ef4931a |
| humanhash: | fruit-magnesium-twenty-march |
| File name: | rDHL_Shipping_Doc-AWB_13700658ME85E1306221_Pdf.vbs |
| Download: | download sample |
| Signature | RemcosRAT |
| File size: | 1'063'813 bytes |
| First seen: | 2025-11-06 12:30:08 UTC |
| Last seen: | 2025-11-06 14:02:56 UTC |
| File type: |  vbs |
| MIME type: | text/plain |
| ssdeep | 24576:ysjCU/YyAGJzBTYXfNuvt5vDJ4uuMirI7pVod3:yxyAGDcVpMagVop |
| Threatray | 74 similar samples on MalwareBazaar |
| TLSH | T1F33569BC3418ECA44558EEA3E3B6B504056FFE038077250ABE52DBC53B7214697B3A97 |
| Magika | vba |
| Reporter |  FXOLabs |
| Tags: | RemcosRAT vbs |
Intelligence
File Origin
# of uploads :
2
# of downloads :
73
Origin country :
BRVendor Threat Intelligence
Detection:
n/a
Verdict:
Malicious
Score:
70%
Tags:
obfuscate xtreme shell
Verdict:
Suspicious
Labled as:
JS/Agent.DGI
Verdict:
Malicious
File Type:
text
First seen:
2025-11-06T00:07:00Z UTC
Last seen:
2025-11-06T20:31:00Z UTC
Hits:
~1000
Detections:
HEUR:Trojan.Script.Generic Trojan-Downloader.JS.Cryptoload.sb
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Gathering data
Detection:
remcos
Verdict:
Malicious
Threat:
Trojan-Downloader.JS.Cryptoload
Threat name:
Script-WScript.Backdoor.Remcos
Status:
Malicious
First seen:
2025-11-06 03:33:22 UTC
File Type:
Text (Python)
AV detection:
7 of 23 (30.43%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
donutloader
remcos
Similar samples:
+ 64 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
10/10
Tags:
collection discovery execution
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Command and Scripting Interpreter: PowerShell
Drops startup file
Badlisted process makes network request
Detected Nirsoft tools
NirSoft MailPassView
NirSoft WebBrowserPassView
Process spawned unexpected child process
Malware family:
WebBrowserPassView
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.