MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 73555e0295eb358b1eeff4e4cefbc975af335c0f67cbd5c652b2d67acd37cbfe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 12


Intelligence 12 IOCs YARA 33 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 73555e0295eb358b1eeff4e4cefbc975af335c0f67cbd5c652b2d67acd37cbfe
SHA3-384 hash: 4ded8cf58da8b8fcb1d19f08adb54112ff0dd98c9cbcedabb2de6e943bc6d924deafe0d877f64037b9536131cd6e9a00
SHA1 hash: 12db0504fce27a50b245d14598704f591e866265
MD5 hash: 81dc08bc1544bcffcad0fe6c8e7221bb
humanhash: robert-item-kentucky-march
File name:1000000244509.js
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:3'230'124 bytes
First seen:2026-07-07 11:19:18 UTC
Last seen:2026-07-24 12:17:52 UTC
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 49152:LNmAgxvD5pezOLi0e24jBTQyqFccuCprS+YvsnP9r:Y
TLSH T113E5F1114AC46FB5CFAC5A1D80FE161FE3E04E8A9016B589EB33BD46FFE7644410B299
Magika javascript
Reporter abuse_ch
Tags:js RAT RemcosRAT

Intelligence

File Origin
# of uploads :
4
# of downloads :
154
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a4ce0cd762b0b26f3d1374c
Tags:
vmdetect cobalt
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm anti-vm aspnet_compiler base64 base64 downloader encrypted evasive evasive fingerprint lolbin obfuscated powershell reconnaissance repaired xloader
Link:
https://www.filescan.io/uploads/6a4ce0cd946c69b3ac781ded/reports/e73bb63d-2a9b-4ac6-a320-2446d5f78249/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/73555e0295eb358b1eeff4e4cefbc975af335c0f67cbd5c652b2d67acd37cbfe
Verdict:
Malicious
File Type:
js
First seen:
2026-07-07T04:47:00Z UTC
Last seen:
2026-07-09T09:03:00Z UTC
Hits:
~1000
Detections:
HEUR:Trojan.Script.Generic Trojan.Win32.InjectorNetT.s PDM:Trojan.Win32.Generic Backdoor.Remcos.TCP.C&C Trojan.Win32.Inject.sb Trojan.JS.SAgent.sb
Link:
https://opentip.kaspersky.com/73555e0295eb358b1eeff4e4cefbc975af335c0f67cbd5c652b2d67acd37cbfe/results?tab=lookup
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
evad.rans.troj.spyw.expl
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1938478
Signature
AI detected malicious Powershell script
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to register a low level keyboard hook
Contains functionality to steal Internet Explorer form passwords
Contains functionalty to change the wallpaper
Detected Remcos RAT
Found malware configuration
Injects a PE file into a foreign processes
JavaScript file contains suspicious strings
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Unusual module load detection (module proxying)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Yara detected Powershell decode and execute
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1938478 Sample: 1000000244509.js Startdate: 07/07/2026 Architecture: WINDOWS Score: 100 44 Suricata IDS alerts for network traffic 2->44 46 Found malware configuration 2->46 48 Malicious sample detected (through community Yara rule) 2->48 50 10 other signatures 2->50 7 wscript.exe 3 2->7         started        11 svchost.exe 1 1 2->11         started        process3 dnsIp4 38 C:\...\script_xTHksYGYLaer_1783430124807.ps1, ASCII 7->38 dropped 64 Suspicious powershell command line found 7->64 66 Wscript starts Powershell (via cmd or directly) 7->66 68 Bypasses PowerShell execution policy 7->68 70 3 other signatures 7->70 14 powershell.exe 16 7->14         started        17 taskkill.exe 1 7->17         started        42 127.0.0.1 unknown unknown 11->42 file5 signatures6 process7 signatures8 72 Writes to foreign memory regions 14->72 74 Injects a PE file into a foreign processes 14->74 19 aspnet_compiler.exe 4 3 14->19         started        24 aspnet_compiler.exe 14->24         started        26 conhost.exe 14->26         started        30 5 other processes 14->30 28 conhost.exe 17->28         started        process9 dnsIp10 40 133.18.107.191, 4440, 49704, 49705 KIRKAGOYAJAPANIncJP Japan 19->40 32 C:\Users\user\AppData\...\Login Data.tmp, SQLite 19->32 dropped 34 C:\Users\user\AppData\...\Login Data.tmp, SQLite 19->34 dropped 36 C:\Users\user\...\Login Data For Account.tmp, SQLite 19->36 dropped 52 Detected Remcos RAT 19->52 54 Tries to harvest and steal browser information (history, passwords, etc) 19->54 56 Contains functionality to bypass UAC (CMSTPLUA) 24->56 58 Contains functionalty to change the wallpaper 24->58 60 Contains functionality to steal Internet Explorer form passwords 24->60 62 2 other signatures 24->62 file11 signatures12
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/73555e0295eb358b1eeff4e4cefbc975af335c0f67cbd5c652b2d67acd37cbfe
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/73555e0295eb358b1eeff4e4cefbc975af335c0f67cbd5c652b2d67acd37cbfe/
Verdict:
Malicious
Threat:
Family.REMCOS
Link:
https://tip.neiki.dev/file/73555e0295eb358b1eeff4e4cefbc975af335c0f67cbd5c652b2d67acd37cbfe
Threat name:
Win32.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2026-07-07 07:50:10 UTC
File Type:
Text (JavaScript)
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=onkv4auv5m2ywhxp6tsm566jowxtgxapm7f5lrsswllhvtjxzp7a._file
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost collection defense_evasion execution rat suricata
Link:
https://tria.ge/reports/260707-ne6e6sgx31/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Command and Scripting Interpreter: PowerShell
Family: Remcos
Suricata alert: REMCOS RAT Malware Inbound C2 Communication
Suricata alert: REMCOS RAT Malware Outbound C2 Communication
Malware Config
C2 Extraction:
133.18.107.191:4440
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/73555e0295eb/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/73555e0295eb358b1eeff4e4cefbc975af335c0f67cbd5c652b2d67acd37cbfe

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Base64_Encoded_Powershell_Directives
Create hunting rule
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Author:ditekSHen
Description:Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:Remcos_unpacked_PulseIntel
Create hunting rule
Author:PulseIntel
Description:Remcos Payload
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:Windows_Trojan_Remcos_921ef449
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Remcos_b296e965
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.remcos.
Rule name:win_remcos_rat_unpacked
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in remcos rat Samples.
Rule name:win_remcos_w0
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in remcos rat Samples.
Rule name:yarahub_win_remcos_rat_unpacked_aug_2023
Create hunting rule
Author:Matthew @ Embee_Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments