MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 683f89ca56d738dcb64308f07c3dcfd9d036126372cda6845914dba40f2e0c2b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 683f89ca56d738dcb64308f07c3dcfd9d036126372cda6845914dba40f2e0c2b
SHA3-384 hash: 4974e89b4ff64803148595c76477e78ad83deb87bfb27bda61e044d0e9f2fd94ebe4ce4e1cc41113f88d6fe52904b4b7
SHA1 hash: 9a686c93a12ffa63916c80d46b3767319ad47c14
MD5 hash: 954fe063257ace86ad0ffe24b37368cf
humanhash: kilo-harry-artist-don
File name:PO-041-P14013.pdf.cmd
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:4'028 bytes
First seen:2026-08-28 16:18:08 UTC
Last seen:Never
File type:cmd cmd
MIME type:text/plain
ssdeep 96:GiexoPUuGZYdFXuB3JU80zsFMedj8z5tfwZzlLdf+R8AR7glI:GihSQ5zCbfeKi
TLSH T1D681B500C374C2548C9E68BDA7875B568D3A5C06ACC20D5596F29D532E19E0EE33BF8A
Magika batch
Reporter lowmal3
Tags:cmd RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
53
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
base64 cmd encrypted lolbin masquerade powershell
Link:
https://www.filescan.io/uploads/6a91b4c4b45b8a5ed9d9946c/reports/c0b333e3-7f5f-41aa-adb6-eca26afaaf06/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/683f89ca56d738dcb64308f07c3dcfd9d036126372cda6845914dba40f2e0c2b
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-28T10:51:00Z UTC
Last seen:
2026-08-28T13:13:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/683f89ca56d738dcb64308f07c3dcfd9d036126372cda6845914dba40f2e0c2b/results?tab=lookup
Result
Threat name:
GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1965407
Signature
Found suspicious powershell code related to unpacking or dynamic code loading
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Uses an obfuscated file name to hide its real file extension (double extension)
Writes to foreign memory regions
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/683f89ca56d738dcb64308f07c3dcfd9d036126372cda6845914dba40f2e0c2b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/683f89ca56d738dcb64308f07c3dcfd9d036126372cda6845914dba40f2e0c2b/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=na7ytssw244nznsdbdyhypop3hidmetdolg2nbczctn2idzobqvq._file
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:guloader family:remcos botnet:remotehost discovery downloader execution persistence rat
Link:
https://tria.ge/reports/260828-tr1y4szhnh/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Executes a command shell one-liner
System Location Discovery: System Language Discovery
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Contacts third-party web service commonly abused for C2
Executes dropped EXE
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Family: Guloader,Cloudeye
Family: Remcos
Malware Config
C2 Extraction:
141.98.10.129:2404
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments