MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4e47423433e88ff4cd7dcd5c03f528cdf6c31b419c5b5e6e123dacfa4890814c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4e47423433e88ff4cd7dcd5c03f528cdf6c31b419c5b5e6e123dacfa4890814c
SHA3-384 hash: 15c5a0bd65cf8d3f2b992e4744d416070991ce468b871a5cf72cffbb70e463474ee3d60275a02e97b545bde33d1fc2ce
SHA1 hash: 521a6c829cb2a7498ab0dd9eef965f1775356973
MD5 hash: 021e786f50fbdbc72a137211a73db9dc
humanhash: three-delta-neptune-juliet
File name:Statement of Account (SOA).xlx.js
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:572'562 bytes
First seen:2026-08-27 08:18:03 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 12288:3t9KZeyCzAjQ+EXcodNDzgcNN/02GTlMu8q:3TVTO2YWq
TLSH T11FC4332167FE5119F2F3AF54AEF865968D7EBEA22E36D05C1150024E0A72E80DDB0737
TrID 66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1)
33.3% (.MP3) MP3 audio (1000/1)
Magika txt
Reporter abuse_ch
Tags:js RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
128
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.25834.JsHeur.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
aes base64 conhost crypto evasive lolbin masquerade obfuscated persistence powershell repaired squirrel wscript
Link:
https://www.filescan.io/uploads/6a8ff2d226a66b5203006651/reports/1d9c4505-c80e-442a-9fd1-653c8f28ba61/overview
Verdict:
Malicious
Labled as:
JS/LausivLoader.J trojan
Link:
https://www.hybrid-analysis.com/sample/4e47423433e88ff4cd7dcd5c03f528cdf6c31b419c5b5e6e123dacfa4890814c
Verdict:
Malicious
File Type:
js
First seen:
2026-08-26T23:43:00Z UTC
Last seen:
2026-08-27T03:33:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/4e47423433e88ff4cd7dcd5c03f528cdf6c31b419c5b5e6e123dacfa4890814c/results?tab=lookup
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1964590
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
Attempt to bypass Chrome Application-Bound Encryption
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Contains functionality to bypass UAC (CMSTPLUA)
Creates autostart registry keys with suspicious names
Creates autostart registry keys with suspicious values (likely registry only malware)
Creates multiple autostart registry keys
Detected Remcos RAT
Encrypted powershell cmdline option found
Found evasive API chain (may stop execution after checking mutex)
Found hidden mapped module (file has been removed from disk)
Found malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Injects a PE file into a foreign processes
Installs a global keyboard hook
JScript performs obfuscated calls to suspicious functions
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Potential evasive JS / VBS script found (domain check)
Powershell drops PE file
Sigma detected: Malicious Base64 Encoded PowerShell Keywords in Command Lines
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Potential Data Stealing Via Chromium Headless Debugging
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Remcos
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call
Sigma detected: Suspicious Encoded PowerShell Command Line
Sigma detected: Suspicious PowerShell Encoded Command Patterns
Sigma detected: Suspicious PowerShell Parameter Substring
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Sigma detected: WScript or CScript Dropper - File
Suspicious execution chain found
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Unusual module load detection (module proxying)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Windows Shell Script Host drops VBS files
Windows shortcut file (LNK) contains suspicious command line arguments
Writes to foreign memory regions
Wscript called in batch mode (surpress errors)
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Yara detected Powershell decode and execute
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1964590 Sample: Statement of Account (SOA).xlx.js Startdate: 27/08/2026 Architecture: WINDOWS Score: 100 107 sixmexicos.com 2->107 139 Found malware configuration 2->139 141 Malicious sample detected (through community Yara rule) 2->141 143 Antivirus detection for URL or domain 2->143 145 24 other signatures 2->145 11 wscript.exe 4 2->11         started        15 wscript.exe 1 7 2->15         started        17 startupr.exe 2 3 2->17         started        19 7 other processes 2->19 signatures3 process4 dnsIp5 85 C:\Users\user\AppData\Local\...\id0mtb9vjtgb, ASCII 11->85 dropped 87 C:\Users\user\AppData\Local\...\id0mtb9vjtga, ASCII 11->87 dropped 183 WScript reads language and country specific registry keys (likely country aware script) 11->183 22 conhost.exe 11->22         started        89 C:\Users\user\AppData\Local\...\13zdmtb9vigab, ASCII 15->89 dropped 91 C:\Users\user\AppData\Local\...\13zdmtb9vigaa, ASCII 15->91 dropped 93 C:\Users\user\AppData\...\PhotoStudio.js, Unicode 15->93 dropped 185 JScript performs obfuscated calls to suspicious functions 15->185 187 Suspicious powershell command line found 15->187 189 Wscript starts Powershell (via cmd or directly) 15->189 203 3 other signatures 15->203 25 conhost.exe 15->25         started        95 C:\ProgramData\Remcos\remcos.exe, PE32+ 17->95 dropped 191 Detected Remcos RAT 17->191 193 Creates autostart registry keys with suspicious names 17->193 195 Creates multiple autostart registry keys 17->195 27 remcos.exe 5 3 17->27         started        109 127.0.0.1 unknown unknown 19->109 197 Contains functionality to bypass UAC (CMSTPLUA) 19->197 199 Found evasive API chain (may stop execution after checking mutex) 19->199 201 Writes to foreign memory regions 19->201 205 2 other signatures 19->205 30 aspnet_compiler.exe 19->30         started        32 conhost.exe 19->32         started        34 aspnet_compiler.exe 19->34         started        36 6 other processes 19->36 file6 signatures7 process8 file9 147 Suspicious powershell command line found 22->147 149 Encrypted powershell cmdline option found 22->149 38 powershell.exe 22->38         started        151 Bypasses PowerShell execution policy 25->151 43 powershell.exe 14 15 25->43         started        97 C:\Users\user\AppData\Local\Temp\THCDE0.tmp, PE32+ 27->97 dropped 153 Antivirus detection for dropped file 27->153 155 Multi AV Scanner detection for dropped file 27->155 157 Detected Remcos RAT 27->157 163 4 other signatures 27->163 45 svchost.exe 27->45         started        159 Installs a global keyboard hook 30->159 161 Unusual module load detection (module proxying) 34->161 signatures10 process11 dnsIp12 111 15.204.115.143, 2404, 49705, 49713 OVHFR United States 38->111 77 C:\Users\user\AppData\Local\...\startupr.exe, PE32+ 38->77 dropped 79 C:\Users\user\AppData\Local\Temp\TH8F0F.tmp, PE32+ 38->79 dropped 81 C:\Users\user\AppData\...\cookies.sqlite-shm, data 38->81 dropped 83 4 other malicious files 38->83 dropped 165 Detected Remcos RAT 38->165 167 Tries to harvest and steal browser information (history, passwords, etc) 38->167 169 Writes to foreign memory regions 38->169 177 3 other signatures 38->177 47 wscript.exe 38->47         started        51 wscript.exe 7 38->51         started        53 startupr.exe 38->53         started        55 2 other processes 38->55 113 sixmexicos.com 149.56.97.184, 443, 49701, 49702 OVHFR Canada 43->113 171 Attempt to bypass Chrome Application-Bound Encryption 43->171 173 Found hidden mapped module (file has been removed from disk) 43->173 175 Found suspicious powershell code related to unpacking or dynamic code loading 43->175 179 3 other signatures 43->179 file13 signatures14 process15 file16 99 C:\Temp\ps_JnJCx9YbhYyy_1787820046090.ps1, ASCII 47->99 dropped 115 Suspicious powershell command line found 47->115 117 Wscript starts Powershell (via cmd or directly) 47->117 119 Creates autostart registry keys with suspicious values (likely registry only malware) 47->119 133 2 other signatures 47->133 57 powershell.exe 47->57         started        101 C:\Users\user\AppData\Local\...\F9F8B49E.ps1, Unicode 51->101 dropped 103 C:\Users\user\...\PhotoStudioLaunch.vbs, ASCII 51->103 dropped 105 C:\Users\user\AppData\...\PhotoStudio.vbs, CSV 51->105 dropped 121 Windows Shell Script Host drops VBS files 51->121 123 WScript reads language and country specific registry keys (likely country aware script) 51->123 59 conhost.exe 51->59         started        125 Antivirus detection for dropped file 53->125 127 Multi AV Scanner detection for dropped file 53->127 129 Contains functionality to bypass UAC (CMSTPLUA) 53->129 131 Detected Remcos RAT 53->131 62 conhost.exe 55->62         started        64 WerFault.exe 55->64         started        signatures17 process18 signatures19 66 conhost.exe 57->66         started        69 aspnet_compiler.exe 57->69         started        71 aspnet_compiler.exe 57->71         started        75 3 other processes 57->75 181 Suspicious powershell command line found 59->181 73 powershell.exe 59->73         started        process20 signatures21 135 Installs a global keyboard hook 66->135 137 Tries to harvest and steal browser information (history, passwords, etc) 73->137
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/4e47423433e88ff4cd7dcd5c03f528cdf6c31b419c5b5e6e123dacfa4890814c
Gathering data
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/4e47423433e88ff4cd7dcd5c03f528cdf6c31b419c5b5e6e123dacfa4890814c/
Threat name:
Script-JS.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-08-27 00:20:50 UTC
File Type:
Text
AV detection:
7 of 36 (19.44%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jzduenbt5ch7jtl5zvoah5jizx3mgg2btrnv43qshwwpuseqqfga._file
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:gozi family:remcos botnet:remotehost banker collection credential_access discovery execution isfb persistence privilege_escalation rat stealer trojan
Link:
https://tria.ge/reports/260827-j7kxqaer8y/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
outlook_office_path
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
System Time Discovery
Drops file in Windows directory
Executes a VBScript file via the Windows Script Host.
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Checks computer location settings
Creates a file in the Startup directory
Executes dropped EXE
Adds policy Run key to start application
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Uses browser remote debugging
Family: Gozi
Family: Remcos
Malware Config
C2 Extraction:
15.204.115.143:2404
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments