🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5569cc5568d0e1f574387400b56fbc4e5743f2da9d3b6f1a8c4f65db8b1ad212. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 13


Intelligence 13 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5569cc5568d0e1f574387400b56fbc4e5743f2da9d3b6f1a8c4f65db8b1ad212
SHA3-384 hash: b4066306e450c9be4a7ab6f62f0706b012e9e9743757fd2434d11ce6c786b1f8bb95b0b71299ef44e4981ecb1739811f
SHA1 hash: 794ebf3b2f770a78020cfc787f37ad6a096b944a
MD5 hash: a12cdc84a12c785d235586381ca56a61
humanhash: arkansas-bacon-violet-connecticut
File name:LPO_1761.bat
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:626'875 bytes
First seen:2025-10-29 13:36:12 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/plain
ssdeep 12288:2lyP4JyLj3sBcNz1dfMd9KY03nzKBqJNYvVOW/Y8Tzzk44sG4:2SNLjpNz1l8KH3zXJ6vVpTA1sG4
TLSH T135D423639F842CF2C36C022D25BD59EF27F85B524123D44FCA279AEB9908238581ED5F
Magika batch
Reporter smica83
Tags:bat RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
LPO_1761.bat
Verdict:
Malicious activity
Analysis date:
2025-10-29 13:37:58 UTC
Tags:
susp-powershell
Link:
https://app.any.run/tasks/58c4ddf2-7ce6-49ba-8c41-3bd91ad57a20

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/34615/
Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=690218859942f1282eca13f9
Tags:
ransomware obfuscate autorun shell
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching cmd.exe command interpreter
Launching a process
DNS request
Connection attempt
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Changing a file
Creating a file in the %temp% subdirectories
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Labled as:
TrojanDropper/VBS.Agent
Link:
https://www.hybrid-analysis.com/sample/5569cc5568d0e1f574387400b56fbc4e5743f2da9d3b6f1a8c4f65db8b1ad212
Verdict:
Malicious
File Type:
unix shell
First seen:
2025-10-29T08:51:00Z UTC
Last seen:
2025-10-31T11:07:00Z UTC
Hits:
~1000
Detections:
Trojan.PowerShell.AmsiBypass.sb HEUR:Trojan.BAT.Obfus.gen
Link:
https://opentip.kaspersky.com/5569cc5568d0e1f574387400b56fbc4e5743f2da9d3b6f1a8c4f65db8b1ad212/results?tab=lookup
Result
Threat name:
Remcos, PureLog Stealer, zgRAT
Create hunting rule
Detection:
malicious
Classification:
rans.phis.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1803907
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Antivirus detection for dropped file
Attempt to bypass Chrome Application-Bound Encryption
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Detected Remcos RAT
Drops script or batch files to the startup folder
Found hidden mapped module (file has been removed from disk)
Found malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Powershell drops PE file
Powershell is started from unusual location (likely to bypass HIPS)
Reads the Security eventlog
Reads the System eventlog
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Drops script at startup location
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Potential Data Stealing Via Chromium Headless Debugging
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Powershell Decrypt And Execute Base64 Data
Sigma detected: Remcos
Sigma detected: Suspicious PowerShell IEX Execution Patterns
Sigma detected: System File Execution Location Anomaly
Suricata IDS alerts for network traffic
Suspicious command line found
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Yara detected Powershell decode and execute
Yara detected PureLog Stealer
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Yara detected WebBrowserPassView password recovery tool
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1803907 Sample: LPO_1761.bat Startdate: 29/10/2025 Architecture: WINDOWS Score: 100 97 Suricata IDS alerts for network traffic 2->97 99 Found malware configuration 2->99 101 Malicious sample detected (through community Yara rule) 2->101 103 22 other signatures 2->103 9 cmd.exe 1 2->9         started        12 cmd.exe 2->12         started        14 cmd.exe 2->14         started        16 cmd.exe 2->16         started        process3 signatures4 133 Suspicious powershell command line found 9->133 135 Bypasses PowerShell execution policy 9->135 137 Suspicious command line found 9->137 18 cmd.exe 1 9->18         started        21 conhost.exe 9->21         started        23 cmd.exe 12->23         started        25 conhost.exe 12->25         started        27 cmd.exe 14->27         started        29 conhost.exe 14->29         started        31 cmd.exe 16->31         started        33 conhost.exe 16->33         started        process5 signatures6 105 Suspicious powershell command line found 18->105 107 Suspicious command line found 18->107 35 powershell.exe 12 41 18->35         started        40 conhost.exe 18->40         started        42 cmd.exe 1 18->42         started        44 powershell.exe 23->44         started        50 3 other processes 23->50 46 powershell.exe 27->46         started        52 3 other processes 27->52 48 powershell.exe 31->48         started        54 2 other processes 31->54 process7 dnsIp8 93 158.94.209.164, 2040, 49719, 49720 JANETJiscServicesLimitedGB United Kingdom 35->93 95 127.0.0.1 unknown unknown 35->95 83 C:\Users\user\AppData\Local\Temp\TH7DE3.tmp, MS-DOS 35->83 dropped 85 C:\Users\user\AppData\Local\Temp\TH7D65.tmp, MS-DOS 35->85 dropped 87 C:\Users\user\AppData\Local\Temp\TH7D45.tmp, PE32 35->87 dropped 91 3 other malicious files 35->91 dropped 109 Contains functionality to bypass UAC (CMSTPLUA) 35->109 111 Detected Remcos RAT 35->111 113 Attempt to bypass Chrome Application-Bound Encryption 35->113 117 13 other signatures 35->117 56 powershell.exe 35->56         started        59 RmClient.exe 14 35->59         started        61 RmClient.exe 1 35->61         started        69 7 other processes 35->69 115 Suspicious powershell command line found 44->115 63 powershell.exe 44->63         started        71 2 other processes 44->71 65 powershell.exe 46->65         started        73 2 other processes 46->73 89 \Device\ConDrv, ASCII 48->89 dropped 67 powershell.exe 48->67         started        file9 signatures10 process11 signatures12 119 Powershell is started from unusual location (likely to bypass HIPS) 56->119 121 Reads the Security eventlog 56->121 123 Reads the System eventlog 56->123 125 Tries to steal Mail credentials (via file registry) 59->125 127 Tries to harvest and steal browser information (history, passwords, etc) 59->127 129 Tries to steal Instant Messenger accounts or passwords 61->129 131 Tries to steal Mail credentials (via file / registry access) 61->131 75 conhost.exe 69->75         started        77 conhost.exe 69->77         started        79 conhost.exe 69->79         started        81 msedge.exe 69->81         started        process13
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/5569cc5568d0e1f574387400b56fbc4e5743f2da9d3b6f1a8c4f65db8b1ad212
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/5569cc5568d0e1f574387400b56fbc4e5743f2da9d3b6f1a8c4f65db8b1ad212/
Verdict:
Malicious
Threat:
Trojan.PowerShell.AmsiBypass
Link:
https://tip.neiki.dev/file/5569cc5568d0e1f574387400b56fbc4e5743f2da9d3b6f1a8c4f65db8b1ad212
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2025-10-29 12:54:43 UTC
File Type:
Text
AV detection:
4 of 24 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kvu4yvli2dq7k5byoqalk354jzluh4w2tu5w6gumj5s5xcy22ija._file
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:nmiri oche collection credential_access defense_evasion discovery execution persistence rat stealer
Link:
https://tria.ge/reports/251029-qwrpfshk3v/
Behaviour
Delays execution with timeout.exe
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Adds Run key to start application
.NET Reactor proctector
Drops startup file
Executes dropped EXE
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Uses browser remote debugging
Detected Nirsoft tools
NirSoft MailPassView
NirSoft WebBrowserPassView
Remcos
Remcos family
Malware Config
C2 Extraction:
158.94.209.164:2040
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/34615/

Comments