MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 698e43542e1d562ec451d4a9b7f05e45256492d33bde848e3804df428e14cd2c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	698e43542e1d562ec451d4a9b7f05e45256492d33bde848e3804df428e14cd2c
SHA3-384 hash:	fa9ba8132c5c180562890c776784d07a8f473608dee4cab743daa50db1a3b951d25b8924f3c7031425907ae616014de0
SHA1 hash:	34a0520d8d32ff812309ccb6175ec454de05447c
MD5 hash:	e9ba73003a85031f62a2720ba20e7170
humanhash:	robin-purple-violet-ten
File name:	SKM_C36826041510200.JS
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	7'320'836 bytes
First seen:	2026-04-17 14:13:54 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	196608:bLTPjNK6LsRjMDyFIT9Hd6v+MbSXZDpVNo3VRWPlU:bLT9sRjMDHJdXMb6ZDp/olz
TLSH	T1EF768348E1787525A8EFC71CC07BD971484E646B394CEE5E303F822C2A51F63466A6EF
Magika	txt
Reporter	abuse_ch
Tags:	js RemcosRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

116

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Clean

Verdict:

Clean

Score:

89.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69e2405cf68adfe1003ac579

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug autoit dropper evasive expired-cert fingerprint keylogger lolbin obfuscated persistence repaired schtasks

Link:

https://www.filescan.io/uploads/69e2404c799d5bf32504c9e7/reports/a08c299f-5d2a-41d2-8afd-440a7d6f52c2/overview

Hybrid Analysis JS/Obfus.A.gen

Verdict:

Suspicious

Labled as:

JS/Obfus.A.gen

Link:

https://www.hybrid-analysis.com/sample/698e43542e1d562ec451d4a9b7f05e45256492d33bde848e3804df428e14cd2c

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-04-15T20:47:00Z UTC

Last seen:

2026-04-18T00:50:00Z UTC

Hits:

~100

Detections:

Trojan-Dropper.JS.SDrop.sb Trojan.JS.SAgent.sb HEUR:Trojan.Script.Generic HEUR:Trojan-Dropper.Script.Generic HEUR:Trojan-Downloader.Script.Generic

Link:

https://opentip.kaspersky.com/698e43542e1d562ec451d4a9b7f05e45256492d33bde848e3804df428e14cd2c/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1900182

Signature

JavaScript source code contains functionality to generate code involving a shell, file or stream

Multi AV Scanner detection for submitted file

Sigma detected: WScript or CScript Dropper

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

97%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/698e43542e1d562ec451d4a9b7f05e45256492d33bde848e3804df428e14cd2c

Malva.RE

Gathering data

CERT.PL MWDB remcos

Detection:

remcos

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/698e43542e1d562ec451d4a9b7f05e45256492d33bde848e3804df428e14cd2c/

Neiki Trojan-Dropper.JS.SDrop

Verdict:

Malicious

Threat:

Trojan-Dropper.JS.SDrop

Link:

https://tip.neiki.dev/file/698e43542e1d562ec451d4a9b7f05e45256492d33bde848e3804df428e14cd2c

ReversingLabs TitaniumCloud Script-JS.Trojan.Heuristic

Threat name:

Script-JS.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-04-16 01:07:31 UTC

File Type:

Text (JavaScript)

AV detection:

5 of 38 (13.16%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nghegvbodvlc5rcr2su3p4c6iuswjewthppijdryatpufdquzuwa._file

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:donutloader family:remcos botnet:april 16th discovery execution loader persistence rat

Link:

https://tria.ge/reports/260417-rkca3agy8m/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Checks computer location settings

Executes dropped EXE

Detects DonutLoader

Family: DonutLoader

Family: Remcos

Malware Config

C2 Extraction:

107.172.13.249:9010

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/698e43542e1d562ec451d4a9b7f05e45256492d33bde848e3804df428e14cd2c