MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5d8df26f099aacb1a96263d727316b05fd2a218a35d4853e7a17cca5fc348420. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 12


Intelligence 12 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5d8df26f099aacb1a96263d727316b05fd2a218a35d4853e7a17cca5fc348420
SHA3-384 hash: 63631efd03f0b8ea5f65aabb81eb9685f03b68fced346818e877b5c6d19bb0b82d1fc0a38eaf4f8bfa52268a88362371
SHA1 hash: 057e4e2876451027e7dba2c3ab8e461f09a1e3ed
MD5 hash: c1031f7c7791278bdbb0df8e4d6fd980
humanhash: seventeen-april-chicken-item
File name:SecuriteInfo.com.Win32.MalwareX-gen.18144443
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:14'778'368 bytes
First seen:2025-08-29 16:18:59 UTC
Last seen:2025-08-29 17:18:12 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 60 x CobaltStrike, 44 x JanelaRAT)
ssdeep 98304:NGJewsoa5i2hOmmi2C7hb7KpEKQklwOJJdzIix8ZcLHGpX4wLm4KBqOUQHOO8Sn1:NGJewsj5iSfhbThklwSJhw4wi4/Hts
TLSH T193E6E510A8D85A07FD3EDFBC959E72500FBAB1A52501BB388F5209D92BD1B58C8439F7
TrID 30.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
21.2% (.EXE) Win32 Executable (generic) (4504/4/1)
9.7% (.EXE) Win16/32 Executable Delphi generic (2072/23)
9.6% (.ICL) Windows Icons Library (generic) (2059/9)
9.5% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter SecuriteInfoCom
Tags:dll RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
106
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/24155/
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68b1d3293e988eb6ab82ee6b
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a file
Сreating synchronization primitives
Connection attempt
Forced shutdown of a system process
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated
Link:
https://www.filescan.io/uploads/68b1d32539a6221faa753b22/reports/5710afaa-c4dc-4bc3-8b11-d28e79199192/overview
Verdict:
Malicious
Labled as:
MSILHeracles.Generic
Link:
https://www.hybrid-analysis.com/sample/5d8df26f099aacb1a96263d727316b05fd2a218a35d4853e7a17cca5fc348420
Verdict:
Unknown
File Type:
executable.pe.32.dll
First seen:
2025-08-29T12:42:00Z UTC
Last seen:
2025-08-29T12:42:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/5d8df26f099aacb1a96263d727316b05fd2a218a35d4853e7a17cca5fc348420/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/9a09cb91-0cb3-4891-9432-9a3b974303cc
Score:
78%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/5d8df26f099aacb1a96263d727316b05fd2a218a35d4853e7a17cca5fc348420
Verdict:
inconclusive
YARA:
6 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.53 Win 32 Exe x86
Link:
https://app.malva.re/file/c1031f7c7791278bdbb0df8e4d6fd980
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5d8df26f099aacb1a96263d727316b05fd2a218a35d4853e7a17cca5fc348420/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2025-08-29 16:21:04 UTC
File Type:
PE (.Net Dll)
Extracted files:
3
AV detection:
16 of 37 (43.24%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lwg7e3yjtkwldklcmplsomllax6suimkgxkikpt2c7gkl7buqqqa._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
error
RemcosRAT
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos discovery rat
Link:
https://tria.ge/reports/250829-tsv49avybs/
Behaviour
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Remcos
Remcos family
Malware Config
C2 Extraction:
80.79.6.185:2404
Unpacked files
SH256 hash:
a719c7a96c1059104b821a76f7ecb1959b815344a399c3af6dac3c07da10668e
MD5 hash:
860f146125b3a25c413c1742ca16bd7f
SHA1 hash:
3a9e09f09cda9631e5c1c2aa615bab3bfcb8ed05
Detections:
win_remcos_w0
Create hunting rule
win_remcos_auto
Create hunting rule
Remcos
Create hunting rule
malware_windows_remcos_rat
Create hunting rule
win_remcos_rat_unpacked
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Link:
https://www.unpac.me/results/a9d5ae96-2522-4998-8db6-b83573bcc08f/
SH256 hash:
84edf34634fe7e45a9e8b5a0ebabed0b0efbd454b08d2bc894a1c3316969e9e0
MD5 hash:
994b1026a170c31c3c247894eb73c57a
SHA1 hash:
4a6043c00d15e3c532e2881b88e85662d469d02d
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/a9d5ae96-2522-4998-8db6-b83573bcc08f/
Parent samples :
e89cb454b197eb77825d7f6ad2d6ce359c2adf004f6bed4b15ce7988a12ff6d6
b879d07c0c1deb75980991437e04f87c50a3a6410609f5cfd4aa68075fa3a795
5d8df26f099aacb1a96263d727316b05fd2a218a35d4853e7a17cca5fc348420
SH256 hash:
5d8df26f099aacb1a96263d727316b05fd2a218a35d4853e7a17cca5fc348420
MD5 hash:
c1031f7c7791278bdbb0df8e4d6fd980
SHA1 hash:
057e4e2876451027e7dba2c3ab8e461f09a1e3ed
Link:
https://www.unpac.me/results/a9d5ae96-2522-4998-8db6-b83573bcc08f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5d8df26f099aacb1a96263d727316b05fd2a218a35d4853e7a17cca5fc348420

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:botnet_plaintext_c2
Create hunting rule
Author:cip
Description:Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.
Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:dependsonpythonailib
Create hunting rule
Author:Tim Brown
Description:Hunts for dependencies on Python AI libraries
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETDLLMicrosoft
Create hunting rule
Author:malware-lu
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:reverse_http
Create hunting rule
Author:CD_R0M_
Description:Identify strings with http reversed (ptth)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

DLL dll 5d8df26f099aacb1a96263d727316b05fd2a218a35d4853e7a17cca5fc348420

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3613700/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/24155/

Comments