MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 61c1041120dd07b3155a6f3d8a0e5e831b1cb37c5ed2b6acb04eb88e4415c2cd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 18


Intelligence 18 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 61c1041120dd07b3155a6f3d8a0e5e831b1cb37c5ed2b6acb04eb88e4415c2cd
SHA3-384 hash: 092a9c16913b2356bc5fc117ecce1660760ec3601aaac328e9cdd4688703256b91b2f65913e37f2fc255fd8b66cdf3ca
SHA1 hash: 87d0098fea6792e60190dd6481b825b2b25cea0c
MD5 hash: 6b1f51f9799e3d97ebf2eade61bc3eb4
humanhash: yankee-fillet-hot-music
File name:att1-240906081402.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:907'776 bytes
First seen:2026-05-21 14:21:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'003 x AgentTesla, 19'911 x Formbook, 12'332 x SnakeKeylogger)
ssdeep 24576:TPDcc0tdP9W1+HWZIyp4E65NtcPqwq7lkE:7NOXHudUDcP1q7C
Threatray 3'964 similar samples on MalwareBazaar
TLSH T1B51512A91278E649D6B903B40A76E2B60B763FADF410C30D8FDEBCE77056760B914742
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter TomU
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
55
Origin country :
CH CH
Vendor Threat Intelligence
Malware configuration found for:
Remcos RoboSki
Details
Remcos
a version number and verbose configuration settings
RoboSki
a decrypted ReZer0 component and possibly a decryption component
RoboSki
a Base64 + XOR/Sub-decrypted component, its associated key, a mutex, a filename, and ReZer0 configuration parameters including: a load type, a download URL and filename (if configured), an interval (if configured), and varying flags
Link:
https://research.acce.ciphertechsolutions.com/results/f8e2a232-28dc-4a03-9d8c-7124fb625e91/
Malware family:
remcos
Create hunting rule
ID:
1
File name:
https://bazaar.abuse.ch/
Verdict:
Malicious activity
Analysis date:
2026-05-21 15:15:53 UTC
Tags:
remcos
Link:
https://app.any.run/tasks/555fa05e-c172-4508-b104-e44cc6a850c1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/67315/
Detection(s):
Win.Packed.Gamarue-10035986-0
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a0f1eef98070a72bb9c7217
Tags:
infosteal shell virus sage
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a process with a hidden window
Creating a file in the %temp% directory
Launching a process
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Sending a custom TCP request
Connection attempt to an infection source
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
bitmap infostealer lokibot packed packed remcos stego
Link:
https://www.filescan.io/uploads/6a0f1c8cefbd399b39c39a6d/reports/823157f8-7857-439c-9320-4a96bf3a7844/overview
Verdict:
Malicious
Labled as:
VIPKeylogger.Generic
Link:
https://www.hybrid-analysis.com/sample/61c1041120dd07b3155a6f3d8a0e5e831b1cb37c5ed2b6acb04eb88e4415c2cd
Verdict:
Malicious
File Type:
exe x32
First seen:
2024-09-09T02:39:00Z UTC
Last seen:
2026-05-20T12:08:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/61c1041120dd07b3155a6f3d8a0e5e831b1cb37c5ed2b6acb04eb88e4415c2cd/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/9e8f0e6d-7ef6-44c1-a607-5c5239207560
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/61c1041120dd07b3155a6f3d8a0e5e831b1cb37c5ed2b6acb04eb88e4415c2cd
Gathering data
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/61c1041120dd07b3155a6f3d8a0e5e831b1cb37c5ed2b6acb04eb88e4415c2cd/
Threat name:
ByteCode-MSIL.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2024-09-09 09:06:07 UTC
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mhaqieja3ud3gfk2n46yuds6qmnrzm34l3jlnlfqj24i4ravylgq._file
Verdict:
malicious
Label(s):
wannacryptor
Create hunting rule
unc_loader_037
Create hunting rule
remcos
Create hunting rule
Similar samples:
47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159
RemcosRAT
4e1899294fcd9043ed50cb9f02a7085b4c243deb30e3c2d5bdaeac2569fe0e6e
RemcosRAT
6f19b81c0a43cadb5d5447e3dc0485c04fd400d4a0656ff4af092ab9faac7213
RemcosRAT
dacf76612ec19aa3f80f070321abac8830e376981ccd5ec4eebd1ba017c6e462
RemcosRAT
+ 3'954 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:3456789 discovery execution persistence rat
Link:
https://tria.ge/reports/260521-rqgsqsfs9q/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Family: Remcos
Malware Config
C2 Extraction:
172.93.220.148:45682
Unpacked files
SH256 hash:
61c1041120dd07b3155a6f3d8a0e5e831b1cb37c5ed2b6acb04eb88e4415c2cd
MD5 hash:
6b1f51f9799e3d97ebf2eade61bc3eb4
SHA1 hash:
87d0098fea6792e60190dd6481b825b2b25cea0c
Link:
https://www.unpac.me/results/7af0a932-5798-4e8e-833e-f2d27dd58923/
SH256 hash:
c59a72e874640d2d2c5669edc14fdeb82a72cbacde61679907d2926b8ed79d08
MD5 hash:
b37fc99b846edbde0d0f36bee1760849
SHA1 hash:
0016396b048dcbda5b87742c32678f706db6362c
Link:
https://www.unpac.me/results/7af0a932-5798-4e8e-833e-f2d27dd58923/
SH256 hash:
6d73a1723e8bb59453b8d79fe000e83f4fe4e976caa717b0fa0d3b6542fed8e7
MD5 hash:
87d09160dc16161b27d8aec7902343d9
SHA1 hash:
04c285ed1c9f9a137fac73f8dfcf0fca817c4c21
Link:
https://www.unpac.me/results/7af0a932-5798-4e8e-833e-f2d27dd58923/
SH256 hash:
8b57a0bf569967168f71c65a9a3fea76d712a114ed75bbf2b5fe50009cef7b1d
MD5 hash:
e14b56671ab9359a74544abff82db87e
SHA1 hash:
06f995c44f40d2655cb00f753a791421896e107e
Detections:
win_remcos_auto
Create hunting rule
win_remcos_w0
Create hunting rule
Remcos
Create hunting rule
Link:
https://www.unpac.me/results/7af0a932-5798-4e8e-833e-f2d27dd58923/
Parent samples :
7815d02dd41dd657438b4b226f4ac1a33d6a37159e34448627088e1354f9ab69
31febdf316e73eaa38c90143a5cd2351cdc4f4921ada4f6b053e5f9c2fa3d752
ee4a689891705260239affa76e606afe4bb0e3100770f0f57a27b6367b0bbb40
b3c084f9fd5fe18129978cccf6d2d2ac972d5c7db3a7378372476f535cc16b8e
a9d403efd3d1d5740a5b1d8a0d691422b4cede106265437f533523f2d7bac16e
cb2b849e4d24527ba41c0e5ae3982ecde5bd91b94b5ae8bb27dc221b4c775891
bb982ea4dad990c5c393a7f1fb85a4daf85be97edcb1e1473cdd0703596ecd6d
cf7d328ce0b9c53b4613030296421f1cc710aa391bca418b3e3566db1128cbe5
165bd5cfc46baeefab886b4375416e2ee062f81ae488a551f5636acdeae1a592
61c1041120dd07b3155a6f3d8a0e5e831b1cb37c5ed2b6acb04eb88e4415c2cd
6a53c56172ce6e29d1ab7e14cbd2ad20069637828cbb8a12d240addcf96dd5bc
85508fcc8478cba03aee3434c45853e3887084f48832f53e28da53909a92da14
c59a535b1a8525c8f5714034085bfa0008e5c4bb55f0c39183c07ac3828a7cdd
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/61c1041120dd/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Executable exe 61c1041120dd07b3155a6f3d8a0e5e831b1cb37c5ed2b6acb04eb88e4415c2cd

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/67315/

Comments