MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7542668fbd197ff685a84163b8b5f309bb126035fe69dbc6c548d39d8092022e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7542668fbd197ff685a84163b8b5f309bb126035fe69dbc6c548d39d8092022e
SHA3-384 hash: 256b68eafedaf517b0304ea411231e22e9f3c054ab5b68e0c295b7aa9a34e75f8904dfb9d93dd8675fb483c79de96e55
SHA1 hash: 806af7f08da84425eddf6fa79a07294be982e993
MD5 hash: ecd762075825d47854be0496b6c8eac2
humanhash: whiskey-wisconsin-lamp-yellow
File name:20262705.gz.zip
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:71'652 bytes
First seen:2026-05-28 09:52:08 UTC
Last seen:2026-05-29 12:33:51 UTC
File type: zip
MIME type:application/zip
ssdeep 1536:pp9FY4faTPiqT5IaS1QswSkaGLgynghkhjlSr:ppnpaT5TrHaJGghqY
TLSH T16163022067FC7F9CD35E812AFC26C9E634F5815AB79E8121A3BE55A71F8C864F14E012
Magika zip
Reporter TomU
Tags:RemcosRAT zip

Intelligence

File Origin
# of uploads :
2
# of downloads :
100
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:Herpaa.vbs
File size:140'635 bytes
SHA256 hash: 4bb00eb0cd1e15ec069e479a6b42e746e6faf74f9b7625cd0c100036a0e592d1
MD5 hash: fc87d1bdba850ab228530a661200122f
MIME type:text/plain
Signature RemcosRAT
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/074f1fb7-f0a6-44d9-b1fe-000c11a37a12/
Detection(s):
Sanesecurity.Foxhole.JS_Zip_1v.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a17b2d75b1db29f5a48a52a
Tags:
n/a
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm fingerprint
Link:
https://www.filescan.io/uploads/6a181061099ef368af080907/reports/1e4a13f9-b3d1-4cb8-a415-6378d4682f93/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/7542668fbd197ff685a84163b8b5f309bb126035fe69dbc6c548d39d8092022e
Verdict:
Malicious
File Type:
zip
First seen:
2026-05-27T23:01:00Z UTC
Last seen:
2026-05-30T05:07:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/7542668fbd197ff685a84163b8b5f309bb126035fe69dbc6c548d39d8092022e/results?tab=lookup
Score:
97%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/7542668fbd197ff685a84163b8b5f309bb126035fe69dbc6c548d39d8092022e
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7542668fbd197ff685a84163b8b5f309bb126035fe69dbc6c548d39d8092022e/
Threat name:
Script-WScript.Trojan.GuLoader
Create hunting rule
Status:
Malicious
First seen:
2026-05-28 02:41:48 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
11 of 38 (28.95%)
Threat level:
  5/5
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost collection discovery execution rat
Link:
https://tria.ge/reports/260528-nw71bsfv7y/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses Microsoft Outlook profiles
Command and Scripting Interpreter: PowerShell
Contacts third-party web service commonly abused for C2
Checks computer location settings
Badlisted process makes network request
Family: Remcos
Malware Config
C2 Extraction:
102.220.160.21:2404
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7542668fbd197ff685a84163b8b5f309bb126035fe69dbc6c548d39d8092022e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:dependsonpythonailib
Create hunting rule
Author:Tim Brown
Description:Hunts for dependencies on Python AI libraries
Rule name:detect_tiny_vbs
Create hunting rule
Author:daniyyell
Description:Detects tiny VBS delivery technique

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip 7542668fbd197ff685a84163b8b5f309bb126035fe69dbc6c548d39d8092022e

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments