🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4db2cee70ccb90d175002f20121d555e0ee938ae61a6e14ec005e4d404fbdbec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 14


Intelligence 14 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4db2cee70ccb90d175002f20121d555e0ee938ae61a6e14ec005e4d404fbdbec
SHA3-384 hash: a78e9aba771da6d9e1d3f934e3083511e0bb7d445c386d6b22ea262776dd001a0b94876e9fc414688a2a27c9f091fafb
SHA1 hash: 0ea645cd94bdb8d750497debbc078ce74b1649df
MD5 hash: 21a4eb5e450748cb9256dd207d447083
humanhash: friend-low-bluebird-eleven
File name:DHL_shipment_documents_invoice_import_tax_certificate_custom_pdf.bat
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:29'640 bytes
First seen:2026-11-10 08:18:16 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/x-msdos-batch
ssdeep 384:h68Nq6wRNQOQpzQo2/JWq2ODwJedaWI68Nq6wRNQOQpzQo2/JWq2ODwJedaWgg:g8qrKwW3+wSdH8qrKwW3+wSd/
TLSH T11AD20971D38979A7D052D3A238B2E1C77593EC136C8BAD48B3DD92442BB572673ED880
Magika batch
Reporter lowmal3
Tags:bat RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Malware family:
remcos
Create hunting rule
ID:
1
File name:
bat
Verdict:
Malicious activity
Analysis date:
2026-11-10 12:28:56 UTC
Tags:
opendir stego payload loader reverseloader rat remcos
Link:
https://app.any.run/tasks/88d58301-9f52-44de-9fd3-e64d7895214d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/98983/
Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af2d35138dc20c444c37b50
Tags:
virus agent
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 crypto encrypted masquerade obfuscated opendir powershell
Link:
https://www.filescan.io/uploads/6af2d381289351f3409398be/reports/b3fb380f-c876-4e28-96f9-6cc808d3fa28/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/4db2cee70ccb90d175002f20121d555e0ee938ae61a6e14ec005e4d404fbdbec
Verdict:
Malicious
File Type:
unix shell
Link:
https://opentip.kaspersky.com/4db2cee70ccb90d175002f20121d555e0ee938ae61a6e14ec005e4d404fbdbec/results?tab=lookup
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/2002866
Signature
.NET source code contains potential unpacker
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to register a low level keyboard hook
Contains functionality to steal Internet Explorer form passwords
Contains functionalty to change the wallpaper
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found malware configuration
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Sample has a suspicious name (potential lure to open the executable)
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Potential PowerShell Command Line Obfuscation
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file registry)
Unusual module load detection (module proxying)
Uses dynamic DNS services
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 2002866 Sample: DHL_shipment_documents_invo... Startdate: 10/11/2026 Architecture: WINDOWS Score: 100 115 lastore7kajp1.duckdns.org 2->115 117 mr-b01.tm-azurefd.net 2->117 119 casoneroutegold-prod-bggfgca0dkaag8a8.b01.azurefd.net 2->119 123 Suricata IDS alerts for network traffic 2->123 125 Found malware configuration 2->125 127 Malicious sample detected (through community Yara rule) 2->127 131 11 other signatures 2->131 10 cmd.exe 1 2->10         started        13 cmd.exe 2->13         started        15 cmd.exe 2->15         started        17 16 other processes 2->17 signatures3 129 Uses dynamic DNS services 115->129 process4 dnsIp5 133 Suspicious powershell command line found 10->133 20 powershell.exe 10->20         started        22 conhost.exe 10->22         started        24 powershell.exe 13->24         started        26 conhost.exe 13->26         started        28 powershell.exe 15->28         started        30 conhost.exe 15->30         started        113 127.0.0.1 unknown unknown 17->113 32 powershell.exe 17->32         started        34 powershell.exe 17->34         started        36 22 other processes 17->36 signatures6 process7 process8 38 powershell.exe 20->38         started        40 powershell.exe 24->40         started        42 powershell.exe 28->42         started        44 powershell.exe 32->44         started        46 powershell.exe 34->46         started        48 powershell.exe 36->48         started        50 powershell.exe 36->50         started        52 powershell.exe 36->52         started        54 3 other processes 36->54 process9 56 3 other processes 38->56 61 5 other processes 40->61 63 5 other processes 42->63 65 3 other processes 44->65 67 3 other processes 46->67 69 3 other processes 48->69 71 3 other processes 50->71 73 2 other processes 52->73 75 4 other processes 54->75 dnsIp10 121 lastore7kajp1.duckdns.org 172.111.137.66, 49718, 49719, 65070 M247RO Germany 56->121 109 4 other malicious files 56->109 dropped 135 Contains functionality to bypass UAC (CMSTPLUA) 56->135 137 Tries to steal Mail credentials (via file registry) 56->137 139 Contains functionalty to change the wallpaper 56->139 141 5 other signatures 56->141 77 cvtres.exe 1 56->77         started        95 C:\Users\user\AppData\Local\...\e3sehs5x.dll, PE32 61->95 dropped 89 2 other processes 61->89 97 C:\Users\user\AppData\Local\...\yiozvwxv.dll, PE32 63->97 dropped 91 2 other processes 63->91 99 C:\Users\user\AppData\Local\...\b1b0v115.dll, PE32 65->99 dropped 79 cvtres.exe 1 65->79         started        101 C:\Users\user\AppData\Local\...\1bplvwf2.dll, PE32 67->101 dropped 81 cvtres.exe 67->81         started        103 C:\Users\user\AppData\Local\...\aaogrmhs.dll, PE32 69->103 dropped 83 cvtres.exe 69->83         started        105 C:\Users\user\AppData\Local\...\wmvymg1q.dll, PE32 71->105 dropped 85 cvtres.exe 71->85         started        107 C:\Users\user\AppData\Local\...\kalaigzz.dll, PE32 73->107 dropped 87 cvtres.exe 73->87         started        111 2 other malicious files 75->111 dropped 93 2 other processes 75->93 file11 signatures12 process13
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/4db2cee70ccb90d175002f20121d555e0ee938ae61a6e14ec005e4d404fbdbec/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jwzm5zymzoinc5iaf4qbehkvlyhosofomgtoctwaaxsnibh33pwa._file
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:frost crypt collection discovery execution persistence rat suricata
Link:
https://tria.ge/reports/261110-j7d46sea65/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
Executes a command shell one-liner
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Family: Remcos
Suricata alert: REMCOS RAT Malware Inbound C2 Communication
Suricata alert: REMCOS RAT Malware Outbound C2 Communication
Malware Config
C2 Extraction:
lastore7kajp1.duckdns.org:65070
lastore7kajp2.duckdns.org:65070
lastore7kajp3.duckdns.org:65070
lastore7kajp4.duckdns.org:65070
lastore7kajp5.duckdns.org:65070
gapo.rako9jabus1.com:65070
Malware Family:
batagent
Create hunting rule
Malicious:
True
Tags:
wmi-activity adapter-discovery malware bat persistence macro-powershell obfuscated self-delete
Link:
https://intel.virussign.com/intelligence/file/4db2cee70ccb90d175002f20121d555e0ee938ae61a6e14ec005e4d404fbdbec
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4db2cee70ccb/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4db2cee70ccb90d175002f20121d555e0ee938ae61a6e14ec005e4d404fbdbec

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/98983/

Comments