MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 545df941a12726eececab025c21f30ca6b96f4dca86883b5e834d2084f40ff9e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	545df941a12726eececab025c21f30ca6b96f4dca86883b5e834d2084f40ff9e
SHA3-384 hash:	0b86855050c4ff5996245a24e986b42c483ae0a7987efb7436c515f9db24297acb130a264743396c52fa6a73256dd58c
SHA1 hash:	3813bf8f8f9ad35d6a727ba8047cb94d9365b563
MD5 hash:	92a21a2ed0a995aad799f1bdfc88610b
humanhash:	zulu-queen-cat-item
File name:	Quotation.js
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	507'088 bytes
First seen:	2026-08-20 07:57:02 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	6144:kOd/4EoyB3vYMZzl/LXWmhUZUzYsoSnIH6c/TvGOOeRMV:N/4hyB3QMZZ/TW1Zfsocu7vzOgMV
TLSH	T15EB4892D4529E91D361CD850D63194D3223FEC8F7F5E814B15CE88FCABC69282867EE9
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	txt
Reporter	abuse_ch
Tags:	js RemcosRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

144

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

aes base64 base64 conhost crypto evasive lolbin obfuscated overlay persistence powershell repaired wscript

Link:

https://www.filescan.io/uploads/6a86b3b0ed8c8fe6310fa128/reports/175ec994-a359-490a-8edd-68240a614de7/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/545df941a12726eececab025c21f30ca6b96f4dca86883b5e834d2084f40ff9e

Joe Sandbox Remcos

Result

Threat name:

Remcos

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1961001

Signature

AI detected malicious Powershell script

Antivirus detection for URL or domain

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Contains functionality to inject threads in other processes

Contains functionality to steal Internet Explorer form passwords

Detected Remcos RAT

Found malware configuration

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Potential evasive JS / VBS script found (domain check)

Sigma detected: Remcos

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Sigma detected: WScript or CScript Dropper - File

Suricata IDS alerts for network traffic

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file registry)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript called in batch mode (surpress errors)

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

67%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/545df941a12726eececab025c21f30ca6b96f4dca86883b5e834d2084f40ff9e

Malva.RE

Gathering data

CERT.PL MWDB remcos

Detection:

remcos

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/545df941a12726eececab025c21f30ca6b96f4dca86883b5e834d2084f40ff9e/

ReversingLabs TitaniumCloud Script-JS.Trojan.Redirector

Threat name:

Script-JS.Trojan.Redirector

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-08-20 07:48:16 UTC

File Type:

Text (JavaScript)

AV detection:

12 of 38 (31.58%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kro7sqnbe4to5twkwas4ehzqzjvzn5g4vbuihnpigtjaqt2a76pa._file

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos botnet:remotehost collection execution persistence rat suricata

Link:

https://tria.ge/reports/260820-jt44fasdph/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

outlook_office_path

Command and Scripting Interpreter: JavaScript

Accesses Microsoft Outlook profiles

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Family: Remcos

Suricata alert: REMCOS RAT Malware Inbound C2 Communication

Suricata alert: REMCOS RAT Malware Outbound C2 Communication

Malware Config

C2 Extraction:

www.ikukuomaproject.com:2404
www.ikukuomaprojectbackup.com:2404
www.ikukuomaprojectbackup1.com:2404

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.95

Link:

https://yomi.yoroi.company/submissions/545df941a12726eececab025c21f30ca6b96f4dca86883b5e834d2084f40ff9e