MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7c4f86b495f183816d3b7b18d15301f7a4c782342ba235aeedadad61989b6751. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 17


Intelligence 17 IOCs YARA 23 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7c4f86b495f183816d3b7b18d15301f7a4c782342ba235aeedadad61989b6751
SHA3-384 hash: 0cf7fb6ff539dafad50a2631f11b70e5e90ff4aefa90cab08658fc6771a815ae5309b0ba8192cdf49baf54eb14dacd16
SHA1 hash: 2f01de9cf3330caaa6a65fcc6499ca8adb40d494
MD5 hash: 11df680208920e87af381126044ec835
humanhash: island-failed-sink-river
File name:7c4f86b495f183816d3b7b18d15301f7a4c782342ba235aeedadad61989b6751
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'325'568 bytes
First seen:2025-12-08 14:45:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 91d07a5e22681e70764519ae943a5883 (121 x Formbook, 32 x a310Logger, 27 x AgentTesla)
ssdeep 24576:Ktb20pkaCqT5TBWgNQ7aoXCps2SK0nIo35dQ1AddvqpmW6A:3Vg5tQ7aoXCtSKP9ADvqb5
Threatray 3'519 similar samples on MalwareBazaar
TLSH T1C955D02373DE8361C7725273BA25B701AEBF782506A5F96B2FD4093DF820122525E673
TrID 40.3% (.EXE) Win64 Executable (generic) (10522/11/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter adrian__luca
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
HU HU
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/489bcd9e-bb5a-47d6-bc5d-7ab0fe65dbfd/
Malware family:
n/a
ID:
1
File name:
7c4f86b495f183816d3b7b18d15301f7a4c782342ba235aeedadad61989b6751
Verdict:
No threats detected
Analysis date:
2025-12-08 16:55:36 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6d555f8e-6479-48cf-b96c-19258028648a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/43154/
Detection(s):
Win.Trojan.Autoit-10037269-0
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6936e4d1881313558a2b8686
Tags:
autoit emotet
Verdict:
Malicious
Labled as:
AIT:Trojan.Nymeria
Link:
https://www.hybrid-analysis.com/sample/7c4f86b495f183816d3b7b18d15301f7a4c782342ba235aeedadad61989b6751
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-11-11T22:41:00Z UTC
Last seen:
2025-12-09T00:28:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/7c4f86b495f183816d3b7b18d15301f7a4c782342ba235aeedadad61989b6751/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e60e12e7-5f47-46f8-b779-197014356177
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/7c4f86b495f183816d3b7b18d15301f7a4c782342ba235aeedadad61989b6751
Verdict:
Malware
YARA:
7 match(es)
Tags:
AutoIt Decompiled Executable PDB Path PE (Portable Executable) PE File Layout Suspect Win 32 Exe x86
Link:
https://app.malva.re/file/11df680208920e87af381126044ec835
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/7c4f86b495f183816d3b7b18d15301f7a4c782342ba235aeedadad61989b6751/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2025-11-12 01:38:15 UTC
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=prhynnev6gbyc3j3pmmncuyb66smparufordllxnvwwwdge3m5iq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
autoit
Create hunting rule
Similar samples:
6420f123d8cfbc66464721f3871561242a8b6db462b85ad3f444d8c938267c5e
RemcosRAT
b5d0552aa20ae4bec3f41829abfb9e3b797512bcc9cdb9e6454b63f6a6727cea
RemcosRAT
ca54ece8f6070eeaac4fae0635129df2ecb9664683cc5bdfc3998d7a351e651e
RemcosRAT
+ 3'509 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost discovery rat
Link:
https://tria.ge/reports/251208-r45rqadk31/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Remcos
Remcos family
Malware Config
C2 Extraction:
192.227.128.173:3028
Verdict:
Malicious
Tags:
Win.Trojan.Autoit-10037269-0
YARA:
n/a
Link:
https://app.threat.zone/submission/321ffcf6-d9d0-442d-81ca-0f2534476972
Unpacked files
SH256 hash:
80d5579ee5aaad3472ac6e8381852d04f30ed2bec9390ea1a646cf75a728380c
MD5 hash:
7bb7f252f0ea0c16486cc0bfd8f631eb
SHA1 hash:
c26af7b6f0f6c84a251b89d12e75c9e613e581bb
Detections:
win_remcos_w0
Create hunting rule
win_remcos_auto
Create hunting rule
Remcos
Create hunting rule
malware_windows_remcos_rat
Create hunting rule
win_remcos_rat_unpacked
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Link:
https://www.unpac.me/results/12ebfae6-26e7-43db-bdbe-37158d7f046a/
Parent samples :
ca54ece8f6070eeaac4fae0635129df2ecb9664683cc5bdfc3998d7a351e651e
589f6b1eb61891dd86a846a75949fbd43ed0d81bb323f4aa1048d0c2f9ff1079
1f770afd971f3372ca89d3eb71f539e415c89323059d3ed475b11d29facc0122
7440ef0eba8981a16f223b10ccccd80671001258b5fd8e95e43161de32b1157d
084fd47a500e122be1ab53c87d6b679bbb34bd1de0d2df5ad8fc7fc75f006f26
7c4f86b495f183816d3b7b18d15301f7a4c782342ba235aeedadad61989b6751
1ae59572bf47373bc03f01a54d369c83c0b5f2ddadd02b6494054189edc3acf0
SH256 hash:
7c4f86b495f183816d3b7b18d15301f7a4c782342ba235aeedadad61989b6751
MD5 hash:
11df680208920e87af381126044ec835
SHA1 hash:
2f01de9cf3330caaa6a65fcc6499ca8adb40d494
Link:
https://www.unpac.me/results/12ebfae6-26e7-43db-bdbe-37158d7f046a/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/7c4f86b495f1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7c4f86b495f183816d3b7b18d15301f7a4c782342ba235aeedadad61989b6751

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Author:ditekSHen
Description:Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:Remcos_unpacked_PulseIntel
Create hunting rule
Author:PulseIntel
Description:Remcos Payload
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:TH_Generic_MassHunt_Win_Malware_2025_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Windows malware mass-hunt rule - 2025
Reference:https://cyfare.net/
Rule name:Windows_Trojan_Remcos_b296e965
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.remcos.
Rule name:win_remcos_rat_unpacked
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in remcos rat Samples.
Rule name:win_remcos_w0
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in remcos rat Samples.
Rule name:YahLover
Create hunting rule
Author:Kevin Falcoz
Description:YahLover
Rule name:yarahub_win_remcos_rat_unpacked_aug_2023
Create hunting rule
Author:Matthew @ Embee_Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/43154/

Comments