MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 56637de7a071133f0d5a4f5caf5a5e5ee40901af122bb63e2d57ac1c00239ac8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 16

Intelligence 16 IOCs YARA 20 File information Comments

SHA256 hash:	56637de7a071133f0d5a4f5caf5a5e5ee40901af122bb63e2d57ac1c00239ac8
SHA3-384 hash:	4604dc3a2c1994b7a1f25c8c5fa2a14b3933751c9e79d68bdf0b0f5b2ab5534683e63d16f35fce2ee9952a50a5bf1285
SHA1 hash:	9e5475a7797cc8775aa0847cc1dcfc6b2702fc43
MD5 hash:	b39d7704b367085b26f86743b28f0001
humanhash:	gee-pluto-west-robin
File name:	a.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	480'256 bytes
First seen:	2026-05-04 22:13:11 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	5d354883fe6f15fcf48045037a99fb7a (126 x RemcosRAT)
ssdeep	12288:Ymnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSCn9:IiLJbpI7I2WhQqZ7C9
Threatray	3'944 similar samples on MalwareBazaar
TLSH	T1EFA4AE02BAD2C072D57161344D2AE735DABDBC212835997BB3E61D5BFD30180A73A7B2
TrID	22.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 22.7% (.EXE) Win64 Executable (generic) (6522/11/2) 17.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 15.7% (.EXE) Win32 Executable (generic) (4504/4/1) 7.0% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
dhash icon	c4d48eaa8ad4d4f8 (1'229 x RemcosRAT, 1 x AsyncRAT, 1 x CustomerLoader)
Reporter	Anonymous
Tags:	exe RAT remcos RemcosRAT

Intelligence

File Origin

# of uploads :

# of downloads :

301

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

Remcos

Details

Remcos

a version number and verbose configuration settings

Link:

https://research.acce.ciphertechsolutions.com/results/e3a1df1b-5ab5-402d-9850-2d0aca70c0f9/

Malware family:

n/a

ID:

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-05-04 22:15:19 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/edafc5d3-613a-4b4e-8a83-243f11044b59

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Remcos

Link:

https://www.capesandbox.com/analysis/64516/

Detection(s):

Win.Trojan.Remcos-10002580-0

Win.Trojan.Remcos-9841897-0

YARA.EMBEERESEARCH_Win_Remcos_Rat_Unpacked.UNOFFICIAL

YARA.MALPEDIA_Win_Remcos_Auto.UNOFFICIAL

Gathering data

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching the default Windows debugger (dwwin.exe)

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug cmd crypto evasive evasive eventvwr fingerprint keylogger lolbin microsoft_visual_cc packed rat rat remcos remcos rescoms windows

Link:

https://www.filescan.io/uploads/69f91a3c86e92bda701e7198/reports/aa0404e2-6d50-4a0d-88cd-64f76c413b81/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/56637de7a071133f0d5a4f5caf5a5e5ee40901af122bb63e2d57ac1c00239ac8

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-05-04T19:19:00Z UTC

Last seen:

2026-05-04T19:41:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan.Win32.Generic HEUR:Trojan.Win32.BypassUAC.gen Exploit.Win32.BypassUAC.sb Backdoor.Win32.Remcos.sb Backdoor.Win32.Remcos.f

Link:

https://opentip.kaspersky.com/56637de7a071133f0d5a4f5caf5a5e5ee40901af122bb63e2d57ac1c00239ac8/results?tab=lookup

Malware family:

REMCOS

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/5c90c4e8-1180-4507-8c9d-9bfaba1cade5

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/56637de7a071133f0d5a4f5caf5a5e5ee40901af122bb63e2d57ac1c00239ac8

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

Executable PDB Path PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/b39d7704b367085b26f86743b28f0001

Detection:

remcos

Link:

https://mwdb.cert.pl/sample/56637de7a071133f0d5a4f5caf5a5e5ee40901af122bb63e2d57ac1c00239ac8/

Verdict:

Malicious

Threat:

Family.REMCOS

Link:

https://tip.neiki.dev/file/56637de7a071133f0d5a4f5caf5a5e5ee40901af122bb63e2d57ac1c00239ac8

Threat name:

Win32.Backdoor.Remcos

Status:

Malicious

First seen:

2026-05-04 22:14:27 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

23 of 24 (95.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kzrx3z5aoejt6dk2j5ok6ws6l3sasanpciv3mprnk6wbyabdtlea._file

Verdict:

malicious

Label(s):

remcos

RemcosRAT

413a08efe39bc4eea9841564f4497bf2ab6e5e074d7bf4e7f9be6d80da274e68

RemcosRAT

440836d991a02bc8e8d2e40b2d6512a78a6898ba0d4ef8188339e36584666bc9

RemcosRAT

4a9f2f65791e8bd5f4ba4cac2484577ae8eeb093fd143c1a9e9db88de7b09d7f

RemcosRAT

4d1b163bb13e2156bb5574bd8d885474cf214e003b4b4ea5be19cea3a0635d26

RemcosRAT

7f418aa89e1a6200adcfe264ec8428f7e45e3c381ca37206cb147abdd0e80a68

RemcosRAT

error

RemcosRAT

+ 3'934 additional samples on MalwareBazaar

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos discovery rat

Link:

https://tria.ge/reports/260504-147qrahs8q/

Behaviour

Program crash

System Location Discovery: System Language Discovery

Unpacked files

SH256 hash:

56637de7a071133f0d5a4f5caf5a5e5ee40901af122bb63e2d57ac1c00239ac8

MD5 hash:

b39d7704b367085b26f86743b28f0001

SHA1 hash:

9e5475a7797cc8775aa0847cc1dcfc6b2702fc43

Detections:

win_remcos_auto

win_remcos_w0

Remcos

Link:

https://www.unpac.me/results/086d7cd6-4f7f-4a47-81b1-de044648ee11/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	iexplorer_remcos Create hunting rule
Author:	iam-py-test
Description:	Detect iexplorer being taken over by Remcos

Rule name:	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer Create hunting rule
Author:	ditekSHen
Description:	detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Remcos Create hunting rule
Author:	kevoreilly
Description:	Remcos Payload

Rule name:	REMCOS_RAT_variants Create hunting rule

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	Windows_Trojan_Remcos_921ef449 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_Remcos_b296e965 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.remcos.

Rule name:	win_remcos_rat_unpacked Create hunting rule
Author:	Matthew @ Embee_Research
Description:	Detects strings present in remcos rat Samples.

Rule name:	win_remcos_w0 Create hunting rule
Author:	Matthew @ Embee_Research
Description:	Detects strings present in remcos rat Samples.

Rule name:	yarahub_win_remcos_rat_unpacked_aug_2023 Create hunting rule
Author:	Matthew @ Embee_Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Link

https://www.unpac.me/results/e78c47d7-7b47-4465-ae9d-95a92248412a

Dropping

Remcos

Delivery method

Distributed via e-mail link

Cape

https://www.capesandbox.com/analysis/64516/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample