MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b28f3ef6ee71e7dc7f10d8eda463017b818dd2cfd0afb3832414e7ce156cc6f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7b28f3ef6ee71e7dc7f10d8eda463017b818dd2cfd0afb3832414e7ce156cc6f
SHA3-384 hash: 5d8683b68700ad56d3bfe505ec94711e7809fd9f8a9b671603b0c71d6b6a4a04213bef1a19f420940aeb861ada491147
SHA1 hash: 36f516c85fb7d3d31e4179086a1f35e59c347e07
MD5 hash: eae76aec06ed3fad35a0d75ce371b3e5
humanhash: orange-autumn-ink-golf
File name:modulo offerta-21072026.bat
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:4'729 bytes
First seen:2026-07-22 06:24:57 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/plain
ssdeep 96:N6+UxuX5r25QCffUQPu2V1KO1Tusi2UyR:oNxuX5rgQCf8ET0Y
TLSH T146A1650CC73ED2E6B79D3EA2E44F1E4F98A0481C545A5C0CC9B684C91CE1A5D5A18FEF
Magika powershell
Reporter lowmal3
Tags:bat RemcosRAT Spam-ITA tangentwaves-com

Intelligence

File Origin
# of uploads :
1
# of downloads :
101
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
1e3070e2-0c90-6b40-45db-2d40de696999.eml
Verdict:
Malicious activity
Analysis date:
2026-07-22 11:14:43 UTC
Tags:
arch-exec attc-arch susp-redirect attachments
Link:
https://app.any.run/tasks/f28977b5-d35b-482f-8a82-ba1837f90503

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/75629/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.80898427.22567.4406.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a606279bcffb2c48cb7c957
Tags:
xtreme shell sage
Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Launching a process
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Creating a file in the %AppData% directory
Using the Windows Management Instrumentation requests
Creating a process with a hidden window
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
base64 powershell
Link:
https://www.filescan.io/uploads/6a6062719f6394337a781c28/reports/ce404e82-5fe5-44df-9699-222438264ab0/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/7b28f3ef6ee71e7dc7f10d8eda463017b818dd2cfd0afb3832414e7ce156cc6f
Verdict:
Malicious
File Type:
ps1
First seen:
2026-07-21T07:34:00Z UTC
Last seen:
2026-07-23T05:03:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/7b28f3ef6ee71e7dc7f10d8eda463017b818dd2cfd0afb3832414e7ce156cc6f/results?tab=lookup
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1946288
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Contains functionality to steal Internet Explorer form passwords
Detected Remcos RAT
Detected unusual large event logs (likely related to powershell unpacking)
Found malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Remcos
Sigma detected: Wab/Wabmig Unusual Parent Or Child Processes
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Unusual module load detection (module proxying)
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1946288 Sample: modulo offerta-21072026.bat Startdate: 22/07/2026 Architecture: WINDOWS Score: 100 53 newpat4bk.duckdns.org 2->53 55 newpat4.duckdns.org 2->55 57 tangentwaves.com 2->57 63 Suricata IDS alerts for network traffic 2->63 65 Found malware configuration 2->65 67 Malicious sample detected (through community Yara rule) 2->67 71 14 other signatures 2->71 9 powershell.exe 13 2->9         started        12 cmd.exe 1 2->12         started        14 powershell.exe 13 2->14         started        16 powershell.exe 2->16         started        signatures3 69 Uses dynamic DNS services 55->69 process4 signatures5 79 Suspicious powershell command line found 9->79 81 Writes to foreign memory regions 9->81 83 Found suspicious powershell code related to unpacking or dynamic code loading 9->83 85 Switches to a custom stack to bypass stack traces 9->85 18 wab.exe 6 10 9->18         started        23 conhost.exe 9->23         started        25 wab.exe 9->25         started        27 powershell.exe 17 12->27         started        29 conhost.exe 12->29         started        31 powershell.exe 13 14->31         started        33 conhost.exe 14->33         started        35 conhost.exe 16->35         started        37 powershell.exe 16->37         started        process6 dnsIp7 59 newpat4.duckdns.org 139.28.38.72, 49771, 49772, 49773 DELTAHOST-KYIVUA Ukraine 18->59 47 C:\Users\user\AppData\...\Login Data.tmp, SQLite 18->47 dropped 49 C:\Users\user\AppData\...\Login Data.tmp, SQLite 18->49 dropped 51 C:\Users\user\...\Login Data For Account.tmp, SQLite 18->51 dropped 73 Detected Remcos RAT 18->73 75 Tries to harvest and steal browser information (history, passwords, etc) 18->75 39 cmd.exe 1 18->39         started        41 wab.exe 18->41         started        61 tangentwaves.com 192.185.137.139, 443, 49768, 49770 ORACLE-BMC-31898-OracleCorporationUS United States 27->61 77 Found suspicious powershell code related to unpacking or dynamic code loading 27->77 file8 signatures9 process10 process11 43 conhost.exe 39->43         started        45 reg.exe 1 1 39->45         started       
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/7b28f3ef6ee71e7dc7f10d8eda463017b818dd2cfd0afb3832414e7ce156cc6f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7b28f3ef6ee71e7dc7f10d8eda463017b818dd2cfd0afb3832414e7ce156cc6f/
Threat name:
Script-PowerShell.Trojan.GuLoader
Create hunting rule
Status:
Malicious
First seen:
2026-07-21 12:55:53 UTC
AV detection:
3 of 38 (7.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pmuph33o44ph3r7rbwhnurrqc64brxjm7ufpwobsifhhzykwzrxq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
execution
Link:
https://tria.ge/reports/260722-g648vsbf58/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
Executes a command shell one-liner
Badlisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7b28f3ef6ee71e7dc7f10d8eda463017b818dd2cfd0afb3832414e7ce156cc6f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/75629/

Comments