MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 592573996cbf19a9fc76cb051eb74f5b72d97b4be3cc5b99c53edf284eef6641. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 17


Intelligence 17 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 592573996cbf19a9fc76cb051eb74f5b72d97b4be3cc5b99c53edf284eef6641
SHA3-384 hash: a608e6abe9c6d7d06c59dba6dea9d81037ee6f2b87f488927eeb4cec8683f5de724411ee52f241cb4a0d14b8af0b16db
SHA1 hash: 79a7f1ced00f3f8ffcf18aebf46b6fb32de86de1
MD5 hash: df9c29aa9eae9e604f59540964b33e37
humanhash: william-wolfram-lamp-mike
File name:scan.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'008'712 bytes
First seen:2026-01-20 08:26:16 UTC
Last seen:2026-02-05 15:23:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f4639a0b3116c2cfc71144b88a929cfd (134 x GuLoader, 55 x Formbook, 40 x VIPKeylogger)
ssdeep 24576:QGEtlx3HSXdb7Ms8sz3SXl0afmF/Oyasbn9o1NDQCGS:TGx3yF4s8sTSXl0a+F/Oy1Y5n
TLSH T15A2522C5A586E253CC9080B2C5139DF71A475E2BE26539335792BF3F7CBB9229326213
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10522/11/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon e088a432b2d27098 (4 x RemcosRAT, 3 x GuLoader)
Reporter lowmal3
Tags:exe RemcosRAT signed

Code Signing Certificate

Organisation:Undskyldtes
Issuer:Undskyldtes
Algorithm:sha256WithRSAEncryption
Valid from:2025-11-27T08:16:35Z
Valid to:2026-11-27T08:16:35Z
Serial number: 1be274fdc115b8fada0ee2d9395a7a5c4b0a3dfc
Thumbprint Algorithm:SHA256
Thumbprint: 6bbf7b4b7231e6b74b3380eead3818cd15760a4026a91ff442e2fdbfa446f1ae
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
137
Origin country :
DE DE
Vendor Threat Intelligence
Malware configuration found for:
NSIS
Details
Link:
https://research.acce.ciphertechsolutions.com/results/0e4fa3bb-39b1-4a26-8687-14b3470cfb0c/
Malware family:
remcos
Create hunting rule
ID:
1
File name:
91a12dd5fd081393085fc017341928edc309476dd0a2b6ae7d55564e93fb28fe.zip
Verdict:
Malicious activity
Analysis date:
2026-01-20 03:18:22 UTC
Tags:
arch-exec auto-reg remcos rat
Link:
https://app.any.run/tasks/11589af5-d4ec-4afc-9848-14218e833864

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/49484/
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=696ef3fdf3cf908ba5068eb8
Tags:
shellcode injection virus nsis
Verdict:
Malicious
Labled as:
TrojanDldr.OffLoader.gen
Link:
https://www.hybrid-analysis.com/sample/592573996cbf19a9fc76cb051eb74f5b72d97b4be3cc5b99c53edf284eef6641
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-01-19T21:58:00Z UTC
Last seen:
2026-01-22T05:15:00Z UTC
Hits:
~10000
Detections:
Trojan.Win32.GuLoader.sb HEUR:Trojan-Downloader.Win32.Minix.gen Trojan-Downloader.Win32.Minix.sb Trojan.NSIS.Makoob.sba
Link:
https://opentip.kaspersky.com/592573996cbf19a9fc76cb051eb74f5b72d97b4be3cc5b99c53edf284eef6641/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/fca87f88-aa86-4915-8987-7964129bb775
Result
Threat name:
Remcos, GuLoader
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1853799
Signature
AI detected suspicious PE digital signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Creates autostart registry keys with suspicious names
Detected Remcos RAT
Found direct / indirect Syscall (likely to bypass EDR)
Found hidden mapped module (file has been removed from disk)
Found malware configuration
Joe Sandbox ML detected suspicious sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Writes to foreign memory regions
Yara detected GuLoader
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1853799 Sample: scan.exe Startdate: 20/01/2026 Architecture: WINDOWS Score: 100 71 drive.usercontent.google.com 2->71 73 drive.google.com 2->73 91 Suricata IDS alerts for network traffic 2->91 93 Found malware configuration 2->93 95 Antivirus detection for dropped file 2->95 97 9 other signatures 2->97 10 scan.exe 1 49 2->10         started        14 remcos.exe 24 2->14         started        16 remcos.exe 7 2->16         started        18 remcos.exe 2->18         started        signatures3 process4 file5 65 C:\Users\user\AppData\Local\...\System.dll, PE32 10->65 dropped 111 Tries to detect virtualization through RDTSC time measurements 10->111 113 Unusual module load detection (module proxying) 10->113 115 Switches to a custom stack to bypass stack traces 10->115 20 scan.exe 2 10 10->20         started        25 scan.exe 10->25         started        67 C:\Users\user\AppData\Local\...\System.dll, PE32 14->67 dropped 117 Found direct / indirect Syscall (likely to bypass EDR) 14->117 27 remcos.exe 14->27         started        29 remcos.exe 14->29         started        signatures6 process7 dnsIp8 75 drive.google.com 142.250.188.238, 443, 49698, 49706 GOOGLEUS United States 20->75 77 drive.usercontent.google.com 142.251.40.97, 443, 49699, 49707 GOOGLEUS United States 20->77 55 C:\ProgramData\Remcos\remcos.exe, PE32 20->55 dropped 57 C:\ProgramData\...\remcos.exe:Zone.Identifier, ASCII 20->57 dropped 99 Detected Remcos RAT 20->99 101 Creates autostart registry keys with suspicious names 20->101 31 remcos.exe 24 20->31         started        35 scan.exe 20->35         started        79 142.250.72.161, 443, 49712 GOOGLEUS United States 27->79 103 Found direct / indirect Syscall (likely to bypass EDR) 27->103 37 remcos.exe 27->37         started        file9 signatures10 process11 file12 69 C:\Users\user\AppData\Local\...\System.dll, PE32 31->69 dropped 83 Antivirus detection for dropped file 31->83 85 Multi AV Scanner detection for dropped file 31->85 87 Found hidden mapped module (file has been removed from disk) 31->87 89 4 other signatures 31->89 39 remcos.exe 4 10 31->39         started        44 remcos.exe 31->44         started        signatures13 process14 dnsIp15 81 198.23.177.196, 2404, 49708, 49710 AS-COLOCROSSINGUS United States 39->81 59 C:\Users\user\AppData\Local\Temp\TH6858.tmp, MS-DOS 39->59 dropped 61 C:\Users\user\AppData\Local\Temp\TH6828.tmp, MS-DOS 39->61 dropped 63 C:\Users\user\AppData\Local\Temp\TH6808.tmp, MS-DOS 39->63 dropped 105 Detected Remcos RAT 39->105 107 Writes to foreign memory regions 39->107 109 Maps a DLL or memory area into another process 39->109 46 RmClient.exe 39->46         started        49 RmClient.exe 39->49         started        51 RmClient.exe 39->51         started        53 2 other processes 39->53 file16 signatures17 process18 signatures19 119 Tries to steal Instant Messenger accounts or passwords 46->119 121 Tries to steal Mail credentials (via file / registry access) 46->121 123 Tries to harvest and steal browser information (history, passwords, etc) 49->123 125 Unusual module load detection (module proxying) 51->125
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/592573996cbf19a9fc76cb051eb74f5b72d97b4be3cc5b99c53edf284eef6641
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable NSIS Installer PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/df9c29aa9eae9e604f59540964b33e37
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/592573996cbf19a9fc76cb051eb74f5b72d97b4be3cc5b99c53edf284eef6641/
Threat name:
Win32.Trojan.Guloader
Create hunting rule
Status:
Malicious
First seen:
2026-01-20 01:00:44 UTC
File Type:
PE (Exe)
Extracted files:
24
AV detection:
18 of 37 (48.65%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lesxhglmx4m2t7dwzmcr5n2plnzns62l4pgfxgofh3psqtxpmzaq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
error
RemcosRAT
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost collection discovery persistence rat
Link:
https://tria.ge/reports/260120-kb3y4ady5g/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Windows directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Adds Run key to start application
Contacts third-party web service commonly abused for C2
Executes dropped EXE
Loads dropped DLL
Detected Nirsoft tools
NirSoft MailPassView
Remcos
Remcos family
Malware Config
C2 Extraction:
198.23.177.196:2404
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/82b45511-edf8-42fa-8497-fabbbcdaa194
Unpacked files
SH256 hash:
592573996cbf19a9fc76cb051eb74f5b72d97b4be3cc5b99c53edf284eef6641
MD5 hash:
df9c29aa9eae9e604f59540964b33e37
SHA1 hash:
79a7f1ced00f3f8ffcf18aebf46b6fb32de86de1
Link:
https://www.unpac.me/results/aa5c7474-45da-4cae-bc31-b1ef9b26ede7/
SH256 hash:
9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
MD5 hash:
4add245d4ba34b04f213409bfe504c07
SHA1 hash:
ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
Link:
https://www.unpac.me/results/aa5c7474-45da-4cae-bc31-b1ef9b26ede7/
Malware family:
GuLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/592573996cbf/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/592573996cbf19a9fc76cb051eb74f5b72d97b4be3cc5b99c53edf284eef6641

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Executable exe 592573996cbf19a9fc76cb051eb74f5b72d97b4be3cc5b99c53edf284eef6641

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/49484/

Comments