🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5ceb49490880a023c8b3866153741a9036d7907c49b4aecb331cb9c0f251bdfe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5ceb49490880a023c8b3866153741a9036d7907c49b4aecb331cb9c0f251bdfe
SHA3-384 hash: 520573ba0fa162aaf1644355f2348841b3fcefac543d4551e6cc087b922b10b1efebf697039435b600696bbc4e5ccd1f
SHA1 hash: 2404f97bd4e5e69db555a2ff0d56a7a1d9addea7
MD5 hash: 23b0306be8032d297943a3cfe5811e24
humanhash: romeo-delaware-muppet-queen
File name:paste.ee_d_85AJMNma_decoded_PS.cmd
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'447 bytes
First seen:2025-02-22 23:22:18 UTC
Last seen:2026-05-20 17:43:24 UTC
File type:cmd cmd
MIME type:text/plain
ssdeep 24:ibrx4ucimZuvOtLw1SOD3R6hFAeiQh7n7xhspI8kBKC2sw2xTrcTX:xvZOOq1SOLR2jsiV3JRSTX
TLSH T1903177715354C449C148ADD661BBD449BD7AC43DC6D8DEA3C2E8FE1554DC097A13F072
Magika powershell
Reporter TomU
Tags:cmd remcos RemcosRAT


Avatar
TomU
85f079d42497f232431cf179530b6614d0409b2e7424b9442a9d2f41218bd150 _DOCUMENT_MAIL_MK77123.PDF.gz
419dcf04a8eb8455ea63458338d802c98522f70d2d04cf218d6fcbd2e5d87ba8 _DOCUMENT_MAIL_MK77123.PDF.js

hXXps://paste[.]ee/d/85AJMNma

690b31fd790e1c47724b42c4440c8b729f0ddaa80150bd7cf631f913638c77f9 paste.ee_d_85AJMNma.js
5ceb49490880a023c8b3866153741a9036d7907c49b4aecb331cb9c0f251bdfe paste.ee_d_85AJMNma_decoded_PS.cmd

hXXps://3005.filemail[.]com/api/file/get?filekey=nIx_5T0LxHOBjilNb9CRviabPjrW2dlC-LxeOdJPF_Z_1MP6CuQBS5KcptA&pk_vid=342803d1cc4e3b801739359203b5fe9d
https://www.virustotal.com/gui/url/1fe27980841066c272c061a618dcfdbf7f083ee8216c08e98ec2c40d78ea27ba
https://www.virustotal.com/gui/file/ef4472cf2616798f6d8726e148d68974a7edb830f622d130f58fcdf0837147b1

hXXps://stakloram[.]rs/css/ym.txt
0a75498800959210a5e2dc4e4a54ef8f97997861d794a065114c5234e6d4ed86 stakloram.rs_css_ym.txt

https://www.virustotal.com/gui/file/0a75498800959210a5e2dc4e4a54ef8f97997861d794a065114c5234e6d4ed86
https://www.virustotal.com/gui/file/f828561f75ee664450e1aac29256aa0aff6bd349232f98d33048dde78c0962bf

Remcos RAT C2: meme7.work[.]gd:3124 / 176.65.141[.]238 (Mutex: meme-ZPFPWZ)

Intelligence

File Origin
# of uploads :
2
# of downloads :
107
Origin country :
CH CH
Vendor Threat Intelligence
Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67ba5c3728ab76d43a5c6cab
Tags:
ransomware xtreme shell
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive powershell
Link:
https://www.filescan.io/uploads/67ba5c333afc3763bec1be71/reports/769b0635-8573-4ce8-98fb-46bb774d2532/overview
Verdict:
Malicious
Labled as:
PWSH.Downloader.D.Generic
Link:
https://www.hybrid-analysis.com/sample/5ceb49490880a023c8b3866153741a9036d7907c49b4aecb331cb9c0f251bdfe
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1621956
Signature
Found suspicious powershell code related to unpacking or dynamic code loading
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Powershell download and load assembly
Suspicious powershell command line found
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/5ceb49490880a023c8b3866153741a9036d7907c49b4aecb331cb9c0f251bdfe
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5ceb49490880a023c8b3866153741a9036d7907c49b4aecb331cb9c0f251bdfe/
Threat name:
Script-PowerShell.Downloader.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2025-02-22 23:22:41 UTC
File Type:
Text (Batch)
AV detection:
6 of 24 (25.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ltvussiiqcqchsftqzqvg5a2sa3nped4jg2k5sztds44b4srxx7a._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
execution
Link:
https://tria.ge/reports/250222-3c79batjx7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
Blocklisted process makes network request
Malware Config
Dropper Extraction:
https://3005.filemail.com/api/file/get?filekey=nIx_5T0LxHOBjilNb9CRviabPjrW2dlC-LxeOdJPF_Z_1MP6CuQBS5KcptA&pk_vid=342803d1cc4e3b801739359203b5fe9d
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Remcos
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/5ceb49490880a023c8b3866153741a9036d7907c49b4aecb331cb9c0f251bdfe

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:Detect_Remcos_RAT
Create hunting rule
Author:daniyyell
Description:Detects Remcos RAT payloads and commands
Rule name:SUSP_PowerShell_Base64_Decode
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects PowerShell code to decode Base64 data. This can yield many FP

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

cmd cmd 5ceb49490880a023c8b3866153741a9036d7907c49b4aecb331cb9c0f251bdfe

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments