MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 67a7464500fdeba256b9f596b6308d0a84f91e7b2ac0b7f8192ce07c2804e874. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 7


Intelligence 7 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 67a7464500fdeba256b9f596b6308d0a84f91e7b2ac0b7f8192ce07c2804e874
SHA3-384 hash: 55e0961bb380671366c375a5cc9d13039cfe24e62a95629f4fd1982b4b8a248b2edb08092797ba778a565caf6b47e9da
SHA1 hash: 2928c2724b9b71c70ee2c94c09c27bd3c9266fc2
MD5 hash: ae869be240b705d75b4e64123d22517f
humanhash: lemon-mississippi-rugby-bluebird
File name:PO#8700983.vbs
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'163'316 bytes
First seen:2026-07-21 22:25:11 UTC
Last seen:2026-07-22 06:55:04 UTC
File type:Visual Basic Script (vbs) vbs
MIME type:text/csv
ssdeep 192:JYZhFIiiY6huhEiY192a2Kk+8pPcILiYQz7Cy8CVEtiYUtstxyLIhEiYEjk8sKPc:J5RdJFsG
TLSH T17B35A392BB115E91F07036C2BA250BD8A7AAD376EDE1144DEE4E1EF708F91E4C9F1118
Magika txt
Reporter abuse_ch
Tags:RAT RemcosRAT vbs


Avatar
abuse_ch
RemcosRAT C2:
107.174.33.15:2404

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
107.174.33.15:2404 https://threatfox.abuse.ch/ioc/1855090/

Intelligence

File Origin
# of uploads :
103
# of downloads :
14
Origin country :
NL NL
Vendor Threat Intelligence
No detections
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6a606a489f6394337a7833e0/reports/6d5c7440-f2f0-459c-a66c-699ffa927630/overview
Result
Threat name:
n/a
Detection:
malicious
Classification:
expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1946301
Signature
Antivirus / Scanner detection for submitted sample
Creates processes via WMI
Detected large data written to user environment variables, potentially indicating payload staging for fileless execution
Found suspicious powershell code related to unpacking or dynamic code loading
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Yara detected Powershell decode and execute
Behaviour
Behavior Graph:
Download SVG
Score:
43%
Verdict:
Susipicious
File Type:
SCRIPT
Link:
https://malprob.io/report/67a7464500fdeba256b9f596b6308d0a84f91e7b2ac0b7f8192ce07c2804e874
Gathering data
Gathering data
Threat name:
Win32.Dropper.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-07-21 12:55:54 UTC
File Type:
Text (VBS)
AV detection:
7 of 36 (19.44%)
Threat level:
  3/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=m6tumria7xv2evvz6wllmmenbkcpsht3flalp6azftqhykae5b2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/67a7464500fdeba256b9f596b6308d0a84f91e7b2ac0b7f8192ce07c2804e874

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_tiny_vbs
Create hunting rule
Author:daniyyell
Description:Detects tiny VBS delivery technique

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments