🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5d8c15bb1165dde4e3022a4870401dd4f878aadb532aaabb9e38f0ef68d6dd44. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5d8c15bb1165dde4e3022a4870401dd4f878aadb532aaabb9e38f0ef68d6dd44
SHA3-384 hash: 4f5f11156dddafc671ea0ee080c737c82b289a9f6dc9ec4e8687390825ba2435bad1fcc3e261665b70a203f1b7e7c46c
SHA1 hash: cef4c801cd4b68d4fd8c0ce3741a054f16188402
MD5 hash: adab01c299262e537ddc74c56295bd18
humanhash: delta-lion-network-north
File name:awb_fedex_shipping_documents_tax_clearance_custom_duty_2026_08_31_docs.js
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:139'248 bytes
First seen:2026-09-01 06:21:51 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 3072:zTxIfA6pdLZENkTNqi/L66Uk7afvZnGCQ/qWk7CTZcw42G8ncB5W:PxIoeLZEGqi/LmhGR2zT8ncB5W
TLSH T19BD312298F34EE240679F80574A13A0512E8FF534054C9599B8D0CFAB772B0FAB83B4E
Magika javascript
Reporter abuse_ch
Tags:FedEx js RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
188
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.25834.JsHeur.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
aes base64 base64 base64 conhost conhost.exe crypto downloader evasive exploit masquerade obfuscated obfuscated powershell repaired
Link:
https://www.filescan.io/uploads/6a966f54543b13ed1073baf9/reports/7cadfa41-9682-41aa-b92b-99db6fd57084/overview
Verdict:
Malicious
Labled as:
HEUR_Trojan_Script_Generic
Link:
https://www.hybrid-analysis.com/sample/5d8c15bb1165dde4e3022a4870401dd4f878aadb532aaabb9e38f0ef68d6dd44
Verdict:
Malicious
File Type:
js
First seen:
2026-08-31T05:19:00Z UTC
Last seen:
2026-09-03T02:32:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/5d8c15bb1165dde4e3022a4870401dd4f878aadb532aaabb9e38f0ef68d6dd44/results?tab=lookup
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
evad.troj.expl
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1966514
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Encrypted powershell cmdline option found
Found malware configuration
JavaScript file contains suspicious strings
JScript performs obfuscated calls to suspicious functions
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample has a suspicious name (potential lure to open the executable)
Sigma detected: Malicious Base64 Encoded PowerShell Keywords in Command Lines
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call
Sigma detected: Suspicious Encoded PowerShell Command Line
Sigma detected: Suspicious PowerShell Encoded Command Patterns
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Uses dynamic DNS services
Windows Scripting host queries suspicious COM object (likely to drop second stage)
WScript reads language and country specific registry keys (likely country aware script)
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1966514 Sample: awb_fedex_shipping_document... Startdate: 01/09/2026 Architecture: WINDOWS Score: 100 31 lastore7kajp1.duckdns.org 2->31 33 geoxsecurity.ro 2->33 45 Suricata IDS alerts for network traffic 2->45 47 Found malware configuration 2->47 49 Malicious sample detected (through community Yara rule) 2->49 53 16 other signatures 2->53 9 wscript.exe 1 4 2->9         started        13 svchost.exe 1 1 2->13         started        signatures3 51 Uses dynamic DNS services 31->51 process4 dnsIp5 27 C:\Users\user\AppData\Local\...\9yqmtiagychb, ASCII 9->27 dropped 29 C:\Users\user\AppData\Local\...\9yqmtiagycha, ASCII 9->29 dropped 55 JScript performs obfuscated calls to suspicious functions 9->55 57 Windows Scripting host queries suspicious COM object (likely to drop second stage) 9->57 59 Suspicious execution chain found 9->59 61 WScript reads language and country specific registry keys (likely country aware script) 9->61 16 conhost.exe 9->16         started        39 127.0.0.1 unknown unknown 13->39 file6 signatures7 process8 signatures9 41 Suspicious powershell command line found 16->41 43 Encrypted powershell cmdline option found 16->43 19 powershell.exe 21 18 16->19         started        process10 dnsIp11 35 lastore7kajp1.duckdns.org 172.111.163.170, 49700, 49715, 49716 M247RO Italy 19->35 37 geoxsecurity.ro 89.42.218.217, 443, 49699 ROMARGRO Romania 19->37 25 C:\Users\user\AppData\...\qdzfiogaohmgmz.vbs, data 19->25 dropped 23 wscript.exe 19->23         started        file12 process13
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/5d8c15bb1165dde4e3022a4870401dd4f878aadb532aaabb9e38f0ef68d6dd44
Verdict:
inconclusive
YARA:
2 match(es)
Tags:
PowerShell
Link:
https://app.malva.re/file/adab01c299262e537ddc74c56295bd18
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5d8c15bb1165dde4e3022a4870401dd4f878aadb532aaabb9e38f0ef68d6dd44/
Threat name:
Win32.Trojan.Znyonm
Create hunting rule
Status:
Malicious
First seen:
2026-08-31 13:02:44 UTC
File Type:
Text
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lwgbloyrmxo6jyycfjehaqa52t4hrkw3kmvkvo46hdyo62gw3vca._file
Verdict:
malicious
Label(s):
Remcos
Create hunting rule
Link:
https://reports.threatray.com/d03ed133-cd2c-4dda-9397-96f622fcd0d6
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:nexus 31-08-2026 defense_evasion discovery execution rat suricata trojan
Link:
https://tria.ge/reports/260901-g5bj6atdqh/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
System Network Configuration Discovery: Internet Connection Discovery
Drops file in System32 directory
Executes a VBScript file via the Windows Script Host.
Checks computer location settings
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Downloads MZ/PE file
Family: Remcos
Suricata alert: REMCOS RAT Malware Inbound C2 Communication
Suricata alert: REMCOS RAT Malware Outbound C2 Communication
UAC bypass
Malware Config
C2 Extraction:
lastore7kajp1.duckdns.org:65070
lastore7kajp2.duckdns.org:65070
lastore7kajp3.duckdns.org:65070
lastore7kajp4.duckdns.org:65070
lastore7kajp5.duckdns.org:65070
gapo.rako9jabus1.com:65070
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5d8c15bb1165dde4e3022a4870401dd4f878aadb532aaabb9e38f0ef68d6dd44

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:PowerShell_Susp_Parameter_Combo_RID336F
Create hunting rule
Author:Florian Roth
Description:Detects PowerShell invocation with suspicious parameters
Reference:https://goo.gl/uAic1X
Rule name:WScript_Shell_PowerShell_Combo_RID32E7
Create hunting rule
Author:Florian Roth
Description:Detects malware from Middle Eastern campaign reported by Talos
Reference:http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments