MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7788726275b4d212ddaa19c37432474ad929827fcb04f42088c6d459733bbb63. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 16


Intelligence 16 IOCs 1 YARA 21 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7788726275b4d212ddaa19c37432474ad929827fcb04f42088c6d459733bbb63
SHA3-384 hash: 316988a94724eba5335c3f6f8c1f3c10946b47e68bb5f724f046699f61902c4f295cf9cdde79d8116ec0e2fb1f022177
SHA1 hash: cb549fdc56281787368c23543736f485769a4bd2
MD5 hash: ff46f36343e56268a12e9c412a7b0692
humanhash: video-undress-black-georgia
File name:FF46F36343E56268A12E9C412A7B0692.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:503'752 bytes
First seen:2025-12-30 13:20:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1f23f452093b5c1ff091a2f9fb4fa3e9 (282 x GuLoader, 38 x RemcosRAT, 27 x VIPKeylogger)
ssdeep 6144:9p+ggvKTgznI19cCX+RkbgQM1cKdNgExa5jQu8fshtiXb5pd6a7qNoyPQEto5yW:TAOmwmCX1s1cKdN9a5Qu8fsiL5jqUyW
Threatray 4'340 similar samples on MalwareBazaar
TLSH T142B4F10A7B18EA17D45456B8DDE2C609AAB0FD402A2B8B07B370BB5C7E757D1BD0C325
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10522/11/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter abuse_ch
Tags:exe RAT RemcosRAT signed

Code Signing Certificate

Organisation:Departementsafgrelser
Issuer:Departementsafgrelser
Algorithm:sha256WithRSAEncryption
Valid from:2025-12-11T10:32:06Z
Valid to:2026-12-11T10:32:06Z
Serial number: 36079f8ef7dbffa43a626a48e0935660dc56872c
Thumbprint Algorithm:SHA256
Thumbprint: c33d8c60105216a506616e959f032045633f3877637909be16277bcc6d67781f
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
abuse_ch
RemcosRAT C2:
172.94.53.135:3421

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
172.94.53.135:3421 https://threatfox.abuse.ch/ioc/1688515/

Intelligence

File Origin
# of uploads :
1
# of downloads :
127
Origin country :
NL NL
Vendor Threat Intelligence
Malware configuration found for:
GuLoader NSIS
Details
GuLoader
an XOR decryption key and an extracted component
NSIS
extracted archive contents
Link:
https://research.acce.ciphertechsolutions.com/results/f474c58f-d94c-41df-bba0-1835cb2e874b/
Malware family:
remcos
Create hunting rule
ID:
1
File name:
_7788726275b4d212ddaa19c37432474ad929827fcb04f42088c6d459733bbb63.exe
Verdict:
Malicious activity
Analysis date:
2025-12-30 13:21:39 UTC
Tags:
auto-reg remcos rat
Link:
https://app.any.run/tasks/94ea54a3-54fe-4a4e-b888-c4f8b959c84c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/46578/
Verdict:
Malicious
Score:
95.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6953d1977d915bf1778f02c7
Tags:
injection obfusc virus nsis
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug blackhole installer installer installer-heuristic microsoft_visual_cc nsis overlay signed
Link:
https://www.filescan.io/uploads/6953d195127d6a14e0c85983/reports/eec78f07-2ac2-4521-8dcc-550a6675500a/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/7788726275b4d212ddaa19c37432474ad929827fcb04f42088c6d459733bbb63
Result
Gathering data
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-12-27T07:35:00Z UTC
Last seen:
2025-12-28T00:34:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/7788726275b4d212ddaa19c37432474ad929827fcb04f42088c6d459733bbb63/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/cb6ba9cf-21bf-4d01-95aa-e8e794c73651
Result
Threat name:
GuLoader, Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1842065
Signature
AI detected suspicious PE digital signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: New RUN Key Pointing to Suspicious Folder
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Unusual module load detection (module proxying)
Uses dynamic DNS services
Yara detected GuLoader
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
Score:
75%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/7788726275b4d212ddaa19c37432474ad929827fcb04f42088c6d459733bbb63
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable NSIS Installer PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/ff46f36343e56268a12e9c412a7b0692
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/7788726275b4d212ddaa19c37432474ad929827fcb04f42088c6d459733bbb63/
Verdict:
Malicious
Threat:
Family.REMCOSRAT
Link:
https://tip.neiki.dev/file/7788726275b4d212ddaa19c37432474ad929827fcb04f42088c6d459733bbb63
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-12-27 12:05:56 UTC
File Type:
PE (Exe)
Extracted files:
8
AV detection:
14 of 36 (38.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=o6eheytvwtjbfxnkdhbximshjlmstat7zmcpiieiy3kfs4z3xnrq._file
Verdict:
malicious
Label(s):
cloudeye
Create hunting rule
Similar samples:
0cb6636748ff6a60ebf1a4644a7b4c877f8a19edd8c7a2eac10b34d1bd7cbfbf
RemcosRAT
199bd66bf9f7b299ebf9068feb2e8648404097e26f86cabc5462973769d24df5
RemcosRAT
238864be2d731bc5838b95c8bb50b961d19f04b6b64d3daf323db967266fa458
RemcosRAT
29032ae14e315863a55a0851c3e1c9cb246beb4513a279d8b1bf7fac97be6ff7
RemcosRAT
482f10e5f1825368c6cdacf482febf39ed6d035ce866aded813d18890cf86dca
RemcosRAT
79866667d5cd578a1c6eda54a748ff9d316fff39064eecd282bc2a9ad8a5ac7d
RemcosRAT
8eaffa403a0bacae0e43928c07f77ea8540b480eda49e10d4a44079b8e0236fe
RemcosRAT
c92b8de7afab714c39ef49e954887a849f7e0e73c1e916ca20c5db06477551af
RemcosRAT
ea3c63e01dc18acb8940dbbe5bec6c3cdcb6c117b6a213b9e7e02c11caeabee0
RemcosRAT
error
RemcosRAT
f2a42302b9c4f3e6c1e2e5d15dfa09cb41aad80ebc13678c4a412f77d4141ca0
RemcosRAT
+ 4'330 additional samples on MalwareBazaar
Gathering data
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/4d45747e-5544-49c9-8926-d3b82d24f375
Unpacked files
SH256 hash:
7788726275b4d212ddaa19c37432474ad929827fcb04f42088c6d459733bbb63
MD5 hash:
ff46f36343e56268a12e9c412a7b0692
SHA1 hash:
cb549fdc56281787368c23543736f485769a4bd2
Link:
https://www.unpac.me/results/272d197a-fe6b-43e2-a8c1-fa0efc8d2b2b/
SH256 hash:
a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
MD5 hash:
75ed96254fbf894e42058062b4b4f0d1
SHA1 hash:
996503f1383b49021eb3427bc28d13b5bbd11977
Link:
https://www.unpac.me/results/272d197a-fe6b-43e2-a8c1-fa0efc8d2b2b/
SH256 hash:
feb6364375d0ab081e9cdf11271c40cb966af295c600903383b0730f0821c0be
MD5 hash:
ca95c9da8cef7062813b989ab9486201
SHA1 hash:
c555af25df3de51aa18d487d47408d5245dba2d1
Link:
https://www.unpac.me/results/272d197a-fe6b-43e2-a8c1-fa0efc8d2b2b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7788726275b4d212ddaa19c37432474ad929827fcb04f42088c6d459733bbb63

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Author:ditekSHen
Description:Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:Remcos_unpacked_PulseIntel
Create hunting rule
Author:PulseIntel
Description:Remcos Payload
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Windows_Trojan_Remcos_b296e965
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.remcos.
Rule name:win_remcos_rat_unpacked
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in remcos rat Samples.
Rule name:win_remcos_w0
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in remcos rat Samples.
Rule name:yarahub_win_remcos_rat_unpacked_aug_2023
Create hunting rule
Author:Matthew @ Embee_Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/46578/

Comments