MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 570693a6bd10e98ca7c67510f7da41e11ad6d055179c7a9f9bfdd9cf8a39ac78. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	570693a6bd10e98ca7c67510f7da41e11ad6d055179c7a9f9bfdd9cf8a39ac78
SHA3-384 hash:	38e0f4cde759d6abb357ff4d2cf7ae47f430a8681f07363546e5eedd3c16cdf526fa4e4415c1652eb24bd454d618120c
SHA1 hash:	6a72dd39962561eef52010aa444cc9db4bc110ca
MD5 hash:	7b90c05119e26fdbfa1d7e43e8d20568
humanhash:	paris-michigan-coffee-blossom
File name:	7b90c05119e26fdbfa1d7e43e8d20568.js
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	68'711 bytes
First seen:	2026-03-14 19:04:05 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	384:G88888888888888888888888888888888888888888888888888888888888888Y:r
TLSH	T1B463EBF3474E3570936E498B262A85F824E3BDA55AADD8B4F5C3FC560B47ECAC12011B
Magika	javascript
Reporter	abuse_ch
Tags:	js RemcosRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

140

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69b5b13488c80c01586a26ce

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm base64 evasive fingerprint obfuscated obfuscated overlay powershell repaired

Link:

https://www.filescan.io/uploads/69b5b1334678eefbc7abb9f7/reports/504f5e0c-bea7-4a9c-8999-2cac067e2249/overview

Hybrid Analysis HEUR_Trojan_Script_Generic

Verdict:

Malicious

Labled as:

HEUR_Trojan_Script_Generic

Link:

https://www.hybrid-analysis.com/sample/570693a6bd10e98ca7c67510f7da41e11ad6d055179c7a9f9bfdd9cf8a39ac78

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

Detections:

Trojan.JS.SAgent.sb HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/570693a6bd10e98ca7c67510f7da41e11ad6d055179c7a9f9bfdd9cf8a39ac78/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

expl.evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/1883839

Signature

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Creates processes via WMI

JavaScript source code contains functionality to generate code involving a shell, file or stream

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Sigma detected: PowerShell Base64 Encoded IEX Cmdlet

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

31%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/570693a6bd10e98ca7c67510f7da41e11ad6d055179c7a9f9bfdd9cf8a39ac78

Malva.RE

Gathering data

CERT.PL MWDB remcos

Detection:

remcos

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/570693a6bd10e98ca7c67510f7da41e11ad6d055179c7a9f9bfdd9cf8a39ac78/

Neiki Family.REMCOS

Verdict:

Malicious

Threat:

Family.REMCOS

Link:

https://tip.neiki.dev/file/570693a6bd10e98ca7c67510f7da41e11ad6d055179c7a9f9bfdd9cf8a39ac78

ReversingLabs TitaniumCloud Script-JS.Trojan.Malgent

Threat name:

Script-JS.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-03-13 16:50:04 UTC

File Type:

Binary

AV detection:

6 of 24 (25.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=k4djhjv5cduyzj6gouippwsb4ennnucvc6ohvh437xm47crzvr4a._file

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos botnet:fedex discovery execution rat

Link:

https://tria.ge/reports/260314-xq39maes2p/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Process spawned unexpected child process

Remcos

Remcos family

Malware Config

C2 Extraction:

unigedgsinc.duckdns.org:14600
unigedgsinc.duckdns.org:14641
universalgsinc.duckdns.org:14600

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/570693a6bd10e98ca7c67510f7da41e11ad6d055179c7a9f9bfdd9cf8a39ac78