MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4fc2ff172c276cc9a015cb7e61954dae7343fd226f8db61ac8ad91a613490da1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4fc2ff172c276cc9a015cb7e61954dae7343fd226f8db61ac8ad91a613490da1
SHA3-384 hash: fc99373354159020541bef86b369dd50bff87ef5390703f87d7f8b399ecdf8a8397f27db14eca601ad02a54b0bd9dd20
SHA1 hash: 9952f6de20b1cdf00c5b9c12d5d1403f9de07306
MD5 hash: 7ecad5612b943c5ad42eae460967179b
humanhash: snake-blossom-october-one
File name:ORDER - PO_1306.bat
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'019'389 bytes
First seen:2025-11-06 14:19:16 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/plain
ssdeep 24576:GhHGSoeW8K+qst17phfAMCRh1DZ5Tb8UF:GpHzYMg1D3X8UF
Threatray 59 similar samples on MalwareBazaar
TLSH T16825D038CF7158EE016F76DAAD443F79089F0A69E093DBA979E815E917303BA1F2504C
Magika batch
Reporter James_inthe_box
Tags:bat exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
142
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
_4fc2ff172c276cc9a015cb7e61954dae7343fd226f8db61ac8ad91a613490da1.txt
Verdict:
No threats detected
Analysis date:
2025-11-06 14:22:04 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/1eead830-827a-4019-93c5-5a3567cfb413

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/36366/
Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=690cae725a5ed7864e2394ee
Tags:
obfuscate xtreme shell
Result
Verdict:
Clean
Maliciousness:

Behaviour
Running batch commands
Launching cmd.exe command interpreter
Launching a process
Sending a custom TCP request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
base64 evasive masquerade obfuscated powershell
Link:
https://www.filescan.io/uploads/690caea985b61a93a73cedb8/reports/da1e2de8-49fa-45d4-a344-6a96960f1e76/overview
Verdict:
Suspicious
Labled as:
BAT/Agent.BGZ
Link:
https://www.hybrid-analysis.com/sample/4fc2ff172c276cc9a015cb7e61954dae7343fd226f8db61ac8ad91a613490da1
Verdict:
Malicious
File Type:
text
First seen:
2025-11-05T22:27:00Z UTC
Last seen:
2025-11-06T20:28:00Z UTC
Hits:
~1000
Detections:
Trojan.BAT.Agent.sb Trojan.BAT.Agent.cpr HEUR:Trojan.PowerShell.Tesre.sb
Link:
https://opentip.kaspersky.com/4fc2ff172c276cc9a015cb7e61954dae7343fd226f8db61ac8ad91a613490da1/results?tab=lookup
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/4fc2ff172c276cc9a015cb7e61954dae7343fd226f8db61ac8ad91a613490da1
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/4fc2ff172c276cc9a015cb7e61954dae7343fd226f8db61ac8ad91a613490da1/
Verdict:
Malicious
Threat:
Trojan.PowerShell.Tesre
Link:
https://tip.neiki.dev/file/4fc2ff172c276cc9a015cb7e61954dae7343fd226f8db61ac8ad91a613490da1
Threat name:
Script-BAT.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2025-11-06 04:01:43 UTC
File Type:
Text
AV detection:
10 of 23 (43.48%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j7bp6fzme5wmtiavzn7gdfknvzzuh7jcn6g3mgwivwi2me2jbwqq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
donutloader
Create hunting rule
Similar samples:
0660741f7d4b1e5d29d281abbbcdda47eed2cd899227f2b787dc89e5b628cb82
RemcosRAT
0cd503ae4803c5e2386e0377ff9a301b00f37e11dd9f14083d47877637672070
RemcosRAT
0f7a84e311754d30f398cc4a8ea63064c2c14aaade50682ec9d74f6e4e742891
RemcosRAT
4235c4b9a9b9da916671b5efcd96a137de5a20e203aebfb78feb11d2bf03069e
RemcosRAT
4252f52d1291b071cac6435be0f1ab88ecc64d7797def81f495d3af759ecdc22
RemcosRAT
8f4cb07a4333f15fa8e585b00ef08ab329fda9fbc3802fdbdf579c194096ba9d
RemcosRAT
a6a51e6620882856ea22eadca02f23db581bd19571c5461c28302da0f897c3c9
RemcosRAT
e80861f2196fcab3985e686094a14beb8bfbf6ebda37b466d9f514f4dec86b12
RemcosRAT
error
RemcosRAT
+ 49 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
execution
Link:
https://tria.ge/reports/251106-rnlc5sykgl/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4fc2ff172c276cc9a015cb7e61954dae7343fd226f8db61ac8ad91a613490da1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:SUSP_PS1_JAB_Pattern_Jun22_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects suspicious UTF16 and Base64 encoded PowerShell code that starts with a $ sign and a single char variable
Reference:Internal Research
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/36366/

Comments