MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5cb34177d0289e9737e5a261b8d1aac227656b96c768f789d6fcc9bc20adb05e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5cb34177d0289e9737e5a261b8d1aac227656b96c768f789d6fcc9bc20adb05e
SHA3-384 hash:	37582b03baf53625f77e0c0931063385384c6d2e5f3c92063132e2b5f7f917a1fb16487b42b8d04ffe2b046de7cadbf5
SHA1 hash:	c5588fc10a718f0653f3d067071a28c03a0f67fb
MD5 hash:	151f5dd1b4ea1a83c3e94af7577be194
humanhash:	cola-bacon-jupiter-eighteen
File name:	Attn Zapytanie ofertowe 03-270123-0612 DODATKOWE DOSTAWY MAGAZYNU ZAMOWIENIE 03-310123-0614.bat
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	4'468 bytes
First seen:	2025-09-16 13:46:04 UTC
Last seen:	Never
File type:	bat
MIME type:	text/plain
ssdeep	96:ySzffmOsTr6THn9sCaTFbPpRAhkmm1rBbegbOQHV:VffrTaC2FbhRAhbQBbFOgV
TLSH	T1A59141769AF0FE4A4D5AD8A72674B11F13F686CB97185210EC2BB0BA3844FB841E0D85
Magika	powershell
Reporter	Anonymous
Tags:	bat RemcosRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

58

Origin country :

PL

Vendor Threat Intelligence

ANY.RUN

Malware family:

n/a

ID:

1

File name:

Attn Zapytanie ofertowe 03-270123-0612 DODATKOWE DOSTAWY MAGAZYNU ZAMOWIENIE 03-310123-0614.bat

Verdict:

No threats detected

Analysis date:

2025-09-16 13:48:28 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/e26c244d-0c4b-4dbc-878b-b0b965e46a94

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/27738/

CyberFortress Malicious

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68c96a3ce579c633a4b5abc7

Tags:

obfuscate xtreme shell

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/68c96a4adbc6f5a29c47a8cb/reports/fc8c6065-af15-4501-a1be-0fceff466bb5/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/5cb34177d0289e9737e5a261b8d1aac227656b96c768f789d6fcc9bc20adb05e

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

ps1

First seen:

2025-09-16T07:06:00Z UTC

Last seen:

2025-09-16T07:06:00Z UTC

Hits:

~1000

Detections:

Trojan.PowerShell.Agent.ary HEUR:Trojan.Script.Generic BSS:Trojan.Win32.Generic

Link:

https://opentip.kaspersky.com/5cb34177d0289e9737e5a261b8d1aac227656b96c768f789d6fcc9bc20adb05e/results?tab=lookup

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/5cb34177d0289e9737e5a261b8d1aac227656b96c768f789d6fcc9bc20adb05e

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5cb34177d0289e9737e5a261b8d1aac227656b96c768f789d6fcc9bc20adb05e/

Neiki Family.REMCOS

Verdict:

Malicious

Threat:

Family.REMCOS

Link:

https://tip.neiki.dev/file/5cb34177d0289e9737e5a261b8d1aac227656b96c768f789d6fcc9bc20adb05e

ReversingLabs TitaniumCloud Script-PowerShell.Trojan.GuLoader

Threat name:

Script-PowerShell.Trojan.GuLoader

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-09-16 13:46:42 UTC

File Type:

Text

AV detection:

7 of 24 (29.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lszuc56qfcpjon7fujq3runkyitwk24wy5uppcow7te3yifnwbpa._file

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos collection defense_evasion discovery execution persistence rat trojan

Link:

https://tria.ge/reports/250916-q28j6atq19/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Drops file in System32 directory

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses Microsoft Outlook accounts

Adds Run key to start application

Looks up external IP address via web service

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Detected Nirsoft tools

NirSoft MailPassView

NirSoft WebBrowserPassView

Remcos

Remcos family

UAC bypass

Malware Config

C2 Extraction:

ablelifepurp.ydns.eu:57864

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5cb34177d0289e9737e5a261b8d1aac227656b96c768f789d6fcc9bc20adb05e

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/27738/