MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 698f07fd59bf2108814837fac44573087de65354bb7f3a616199e18583291fe2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 12


Intelligence 12 IOCs YARA 32 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 698f07fd59bf2108814837fac44573087de65354bb7f3a616199e18583291fe2
SHA3-384 hash: 483d901ea75a74410712440f73ad367274d4d4c05669c87989944d44263171877aff3e8159e7eb7a6ae5d54b3b45274e
SHA1 hash: 68ae5d11949b11a537563092d54fcdaa87ec5ce5
MD5 hash: 01caddc7d3c52f6d6d0367a9f35e86fa
humanhash: stairway-zebra-alaska-snake
File name:DO2025-ORDER-0168.vbs
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:795'027 bytes
First seen:2025-08-21 07:09:30 UTC
Last seen:2025-08-25 09:12:04 UTC
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 12288:6RkR5REDIB+AFIz3pPKSTUXenE+1ERg5sgBUHqZZ4JkE3fioLAmZjXvm9X:6R85RuIBHFEpCSTkjRg5FucO6oxu9X
Threatray 100 similar samples on MalwareBazaar
TLSH T18CF4C03AC53BBD9B290E1C8C980C1D435D780ED78668EA94DC8D91A771DCA529FAC4FC
Magika vba
Reporter abuse_ch
Tags:RAT RemcosRAT vbs

Intelligence

File Origin
# of uploads :
2
# of downloads :
57
Origin country :
SE SE
Vendor Threat Intelligence
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/22702/
Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68a6c6748fd55a79c5299d36
Tags:
dropper floxif trojan
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/698f07fd59bf2108814837fac44573087de65354bb7f3a616199e18583291fe2
Result
Threat name:
Remcos, Bazar Loader, FloodFix
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1761758
Signature
Antivirus detection for dropped file
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Detected Remcos RAT
Found malware configuration
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Potential malicious VBS script found (has network functionality)
Sigma detected: Remcos
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
VBScript performs obfuscated calls to suspicious functions
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Yara detected Bazar Loader
Yara detected FloodFix
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1761758 Sample: DO2025-ORDER-0168.vbs Startdate: 21/08/2025 Architecture: WINDOWS Score: 100 30 www.aieov.com 2->30 32 geoplugin.net 2->32 34 5isohu.com 2->34 50 Suricata IDS alerts for network traffic 2->50 52 Found malware configuration 2->52 54 Malicious sample detected (through community Yara rule) 2->54 56 13 other signatures 2->56 7 wscript.exe 1 2 2->7         started        11 rad1B9AE.tmp.exe 1 2->11         started        13 rad1B9AE.tmp.exe 2->13         started        signatures3 process4 file5 28 C:\Users\user\AppData\...\rad1B9AE.tmp.exe, PE32 7->28 dropped 58 Benign windows process drops PE files 7->58 60 VBScript performs obfuscated calls to suspicious functions 7->60 62 Windows Scripting host queries suspicious COM object (likely to drop second stage) 7->62 15 rad1B9AE.tmp.exe 5 94 7->15         started        64 Detected Remcos RAT 11->64 signatures6 process7 dnsIp8 36 162.251.121.43, 23148, 49685 UNREAL-SERVERSUS Canada 15->36 38 geoplugin.net 178.237.33.50, 49688, 80 ATOM86-ASATOM86NL Netherlands 15->38 40 www.aieov.com 13.248.169.48, 49689, 49693, 80 AMAZON-02US United States 15->40 20 C:\Users\...\zBPZEuRGiaylwtvifkZtA2.exe.tmp, PE32 15->20 dropped 22 C:\Users\...\z59mQwWfSglnuLqOSR8SP.exe.tmp, PE32 15->22 dropped 24 C:\Users\user\...\y8qkHzHnSpOnkUPKW1S.exe.tmp, PE32 15->24 dropped 26 74 other malicious files 15->26 dropped 42 Contains functionality to bypass UAC (CMSTPLUA) 15->42 44 Detected Remcos RAT 15->44 46 Contains functionalty to change the wallpaper 15->46 48 4 other signatures 15->48 file9 signatures10
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/698f07fd59bf2108814837fac44573087de65354bb7f3a616199e18583291fe2
Verdict:
Malware
YARA:
2 match(es)
Tags:
Base64 Block Base64 Payload Contains Base64 Block Executable PE (Portable Executable) PE Memory-Mapped (Dump) VBScript
Link:
https://app.malva.re/file/01caddc7d3c52f6d6d0367a9f35e86fa
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/698f07fd59bf2108814837fac44573087de65354bb7f3a616199e18583291fe2/
Threat name:
Script-WScript.Dropper.RemcosRAT
Create hunting rule
Status:
Malicious
First seen:
2025-08-19 12:59:00 UTC
File Type:
Text (VBS)
AV detection:
14 of 36 (38.89%)
Threat level:
  3/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nghqp7kzx4qqrakig75mirltbb66mu2uxn7tuylbthqylazjd7ra._file
Verdict:
malicious
Label(s):
floxif
Create hunting rule
remcos
Create hunting rule
Similar samples:
1c0903c89ac226037dc1cae6f7b4b7b44759df8118d9eaaedda7044e5a6b56d1
RemcosRAT
2f21f1c2265b1072bb2f7432dc620643bef446629696d0704ae5ef88102db390
RemcosRAT
4f43805e7984de9622fdd68f77a4cc7e6b131dd0184c0e940ba5c09ca498c537
RemcosRAT
697f3c72a602ef73662c0011a9768a3305f4108674d398d5bf13907c3504309b
RemcosRAT
72290d956d57e4d2370d4d202fe18ed53362b7a35c57ea8ad7b57cf481a98ef7
RemcosRAT
b8b976fc785eaa95fb3087baed16edbd390084e0733e86a66647feeb51a36889
RemcosRAT
d32a410f784daaeee1d50c5d4c40a40e12cdb6383223d3e060391d6f73d7cd3c
RemcosRAT
e1a0ab5cadb0af718230bb8f907c649a313f1ff7bcbed6745c678811ce8a4465
RemcosRAT
fd495f27db494321f0a41d29aaf8d3446b929ca69f0116d017f47a6691ca4216
RemcosRAT
+ 90 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:floxif family:remcos botnet:remotehost backdoor discovery persistence privilege_escalation rat trojan upx
Link:
https://tria.ge/reports/250821-h3wyrazza1/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Program Files directory
UPX packed file
Adds Run key to start application
Enumerates connected drives
ACProtect 1.3x - 1.4x DLL software
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Event Triggered Execution: AppInit DLLs
Detects Floxif payload
Floxif family
Floxif, Floodfix
Remcos
Remcos family
Malware Config
C2 Extraction:
162.251.121.43:23148
162.251.121.43:44237
162.251.121.43:19882
Malware family:
Mimikatz
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/698f07fd59bf/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Author:ditekSHen
Description:Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Rule name:Invoke_Mimikatz
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Invoke-Mimikatz String
Reference:https://github.com/clymb3r/PowerShell/tree/master/Invoke-Mimikatz
Rule name:MALWARE_Win_FloodFix
Create hunting rule
Author:ditekSHen
Description:Detects FloodFix
Rule name:MAL_Floxif_Generic
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Floxif Malware
Reference:Internal Research
Rule name:MAL_Floxif_Generic_RID2DCE
Create hunting rule
Author:Florian Roth
Description:Detects Floxif Malware
Reference:Internal Research
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:remcos_
Create hunting rule
Author:Michelle Khalil
Description:This rule detects unpacked remcos malware samples.
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:Remcos_unpacked_PulseIntel
Create hunting rule
Author:PulseIntel
Description:Remcos Payload
Rule name:SUSP_Microsoft_Copyright_String_Anomaly_2
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Floxif Malware
Reference:Internal Research
Rule name:SUSP_Microsoft_Copyright_String_Anomaly_2_RID3720
Create hunting rule
Author:Florian Roth
Description:Detects Floxif Malware
Reference:Internal Research
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:Windows_Trojan_Remcos_b296e965
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set
Rule name:win_floxif_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.floxif.
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.remcos.
Rule name:win_remcos_rat_unpacked
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in remcos rat Samples.
Rule name:win_remcos_w0
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in remcos rat Samples.
Rule name:yarahub_win_remcos_rat_unpacked_aug_2023
Create hunting rule
Author:Matthew @ Embee_Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/22702/

Comments