MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7dc51536704031085806d8c93ac5654a459c3d5f7f45e3151b4278d2c19fbcf3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 19 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7dc51536704031085806d8c93ac5654a459c3d5f7f45e3151b4278d2c19fbcf3
SHA3-384 hash: b010d733c42ef434ac567bfadbe1c054803af68e605e078261ef2cbc89d1fbf59418815e4502b9538c8624f996de509d
SHA1 hash: 740633c5090ca4675944743b4f98c6fa56519da8
MD5 hash: 7bdfe1eac45d21df4baa5e161f56eb4d
humanhash: montana-november-lemon-twelve
File name:EG91EXGA-128-SGNS.js
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'138'020 bytes
First seen:2026-08-26 13:27:14 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 24576:3WFnkR4SpqgjFDbJkHQJrufqdHh1Bg9tkH4hJ:myvQsNBqk8
TLSH T1483502B067C8D0AB853A5F088FAB421547A4F6C681FF73CEE24B5AD401648C6C7D5FA6
Magika batch
Reporter abuse_ch
Tags:js RAT RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
178
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Trojan.Win64.Krypt.3341.6990.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cmd evasive lolbin obfuscated powershell repaired
Link:
https://www.filescan.io/uploads/6a8ee9bd81394c17eb2fafa2/reports/630bef3b-6277-4bc3-bf02-e4797324b29b/overview
Verdict:
Suspicious
Labled as:
JS/Agent.EWV
Link:
https://www.hybrid-analysis.com/sample/7dc51536704031085806d8c93ac5654a459c3d5f7f45e3151b4278d2c19fbcf3
Verdict:
Malicious
File Type:
js
First seen:
2026-08-26T02:32:00Z UTC
Last seen:
2026-08-27T10:59:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/7dc51536704031085806d8c93ac5654a459c3d5f7f45e3151b4278d2c19fbcf3/results?tab=lookup
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1964120
Signature
.NET source code contains process injector
.NET source code references suspicious native API functions
C2 URLs / IPs found in malware configuration
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to inject threads in other processes
Contains functionality to steal Internet Explorer form passwords
Creates a thread in another existing process (thread injection)
Creates an autostart registry key pointing to binary in C:\Windows
Detected Remcos RAT
Found malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Hijacks the control flow in another process
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
JScript performs obfuscated calls to suspicious functions
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Register Wscript In Run Key
Sigma detected: Remcos
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Tries to detect sandboxes / dynamic malware analysis system (Installed program check)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file registry)
Unusual module load detection (module proxying)
Uses attrib.exe to hide files
Uses cmd line tools excessively to alter registry or file data
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript called in batch mode (surpress errors)
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1964120 Sample: EG91EXGA-128-SGNS.js Startdate: 26/08/2026 Architecture: WINDOWS Score: 100 133 Sigma detected: Register Wscript In Run Key 2->133 135 Found malware configuration 2->135 137 Malicious sample detected (through community Yara rule) 2->137 139 10 other signatures 2->139 10 wscript.exe 1 1 2->10         started        13 wscript.exe 2->13         started        15 wscript.exe 2->15         started        17 svchost.exe 1 1 2->17         started        process3 dnsIp4 149 JScript performs obfuscated calls to suspicious functions 10->149 151 Wscript starts Powershell (via cmd or directly) 10->151 153 Windows Scripting host queries suspicious COM object (likely to drop second stage) 10->153 155 Suspicious execution chain found 10->155 20 cmd.exe 1 10->20         started        23 powershell.exe 8 10->23         started        157 WScript reads language and country specific registry keys (likely country aware script) 13->157 26 cmd.exe 13->26         started        28 cmd.exe 15->28         started        117 127.0.0.1 unknown unknown 17->117 signatures5 process6 file7 141 Wscript starts Powershell (via cmd or directly) 20->141 143 Uses cmd line tools excessively to alter registry or file data 20->143 145 Uses attrib.exe to hide files 20->145 30 powershell.exe 20->30         started        32 powershell.exe 15 20->32         started        34 conhost.exe 20->34         started        36 attrib.exe 1 20->36         started        99 C:\Users\user\...\20267261787752267415.cmd, DOS 23->99 dropped 147 Found suspicious powershell code related to unpacking or dynamic code loading 23->147 38 conhost.exe 23->38         started        40 powershell.exe 26->40         started        44 4 other processes 26->44 42 powershell.exe 28->42         started        46 4 other processes 28->46 signatures8 process9 process10 48 powershell.exe 1 52 30->48         started        52 powershell.exe 40->52         started        54 powershell.exe 42->54         started        file11 91 C:\Users\user\AppData\...\vpwke24w.cmdline, Unicode 48->91 dropped 93 C:\Users\user\...\prefetch_meta_RBRJTQWU.cmd, DOS 48->93 dropped 95 C:\Users\user\...\prefetch_meta_AIIVXWKX.vbs, ASCII 48->95 dropped 97 C:\Users\user\AppData\...\prefetch_meta.dat, DOS 48->97 dropped 121 Creates an autostart registry key pointing to binary in C:\Windows 48->121 123 Writes to foreign memory regions 48->123 125 Maps a DLL or memory area into another process 48->125 127 Loading BitLocker PowerShell Module 48->127 56 choice.exe 48->56         started        61 msiexec.exe 2 48->61         started        63 csc.exe 3 48->63         started        73 2 other processes 48->73 129 Modifies the context of a thread in another process (thread injection) 52->129 131 Creates a thread in another existing process (thread injection) 52->131 65 msiexec.exe 52->65         started        67 choice.exe 52->67         started        69 csc.exe 52->69         started        75 2 other processes 52->75 71 conhost.exe 54->71         started        signatures12 process13 dnsIp14 119 107.175.101.187, 2404, 49710, 49711 NEXEON-NexeonTechnologiesIncUS United States 56->119 101 C:\Users\user\AppData\...\Login Data.tmp, SQLite 56->101 dropped 103 C:\Users\user\AppData\...\Login Data.tmp, SQLite 56->103 dropped 105 C:\Users\user\...\Login Data For Account.tmp, SQLite 56->105 dropped 107 C:\ProgramData\remcos\logs.dat, data 56->107 dropped 159 Contains functionality to bypass UAC (CMSTPLUA) 56->159 161 Detected Remcos RAT 56->161 163 Tries to steal Mail credentials (via file registry) 56->163 175 5 other signatures 56->175 77 conhost.exe 56->77         started        165 Hijacks the control flow in another process 61->165 167 Writes to foreign memory regions 61->167 169 Modifies the context of a thread in another process (thread injection) 61->169 109 C:\Users\user\AppData\Local\...\vpwke24w.dll, PE32 63->109 dropped 79 cvtres.exe 1 63->79         started        171 Creates a thread in another existing process (thread injection) 65->171 173 Injects a PE file into a foreign processes 65->173 81 WerFault.exe 65->81         started        83 conhost.exe 67->83         started        111 C:\Users\user\AppData\Local\...\tbhuv3td.dll, PE32 69->111 dropped 85 cvtres.exe 69->85         started        113 C:\Users\user\AppData\Local\...\o3hisupv.dll, PE32 73->113 dropped 87 cvtres.exe 1 73->87         started        115 C:\Users\user\AppData\Local\...\yk1fcwtx.dll, PE32 75->115 dropped 89 cvtres.exe 75->89         started        file15 signatures16 process17
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/7dc51536704031085806d8c93ac5654a459c3d5f7f45e3151b4278d2c19fbcf3
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7dc51536704031085806d8c93ac5654a459c3d5f7f45e3151b4278d2c19fbcf3/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pxcrkntqiayqqwag3detvrlfjjczypk7p5c6gfi3ij4nfqm7xtzq._file
Verdict:
malicious
Label(s):
Remcos
Create hunting rule
Link:
https://reports.threatray.com/2f803321-db18-4f95-9542-c2079388877f
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost collection defense_evasion execution persistence rat
Link:
https://tria.ge/reports/260826-qqahzsel2s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Views/modifies file attributes
outlook_office_path
Command and Scripting Interpreter: JavaScript
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
Hide Artifacts: Hidden Files and Directories
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Checks computer location settings
Family: Remcos
Malware Config
C2 Extraction:
107.175.101.187:2404
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7dc51536704031085806d8c93ac5654a459c3d5f7f45e3151b4278d2c19fbcf3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Author:ditekSHen
Description:Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Remcos_unpacked_PulseIntel
Create hunting rule
Author:PulseIntel
Description:Remcos Payload
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:Windows_Trojan_Remcos_921ef449
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Remcos_b296e965
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set
Rule name:win_remcos_rat_unpacked
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in remcos rat Samples.
Rule name:win_remcos_w0
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in remcos rat Samples.
Rule name:yarahub_win_remcos_rat_unpacked_aug_2023
Create hunting rule
Author:Matthew @ Embee_Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments