MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 832f4c6ca7b9b61b3a8063355c71f96e5b18e1bfd209df3cd3570b55e5144b4f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	832f4c6ca7b9b61b3a8063355c71f96e5b18e1bfd209df3cd3570b55e5144b4f
SHA3-384 hash:	5ea41394bb27c75a8d87fbe08814e55280c67c264ca4162b10aec0b1ec354161ec33ecfa52cafc555eb7b8e02e6e9a8d
SHA1 hash:	2671234f516c6b79f93bd189bd6ac39d2087ee28
MD5 hash:	c58bdff2dd06fe997d2ac959c9c2557c
humanhash:	enemy-green-charlie-dakota
File name:	BOOKING_CONFIRMATION.js
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	5'259'178 bytes
First seen:	2026-09-21 05:01:52 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	12288:60CV/w+0dhgCnxbOKokMBGLmgF22wds/uZeWfjI95TSdS1wZ/IemrXgcuBKpRuep:X
TLSH	T12A36844F7DF52A30D3528E6B29D519002E7EB2B94CB2E19A59D870370A6382CE4DD7F1
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	txt
Reporter	ppppt
Tags:	js RemcosRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

173

Origin country :

TH

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.JS.DownLoader.10853.6712.6541.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6accef7f853d431abd4d4e6d

Tags:

obfuscate xtreme virus

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

repaired

Link:

https://www.filescan.io/uploads/6ab0ba58e76020415c8166cc/reports/fa7cc65b-2b7f-4c48-acff-07937b46af56/overview

Hybrid Analysis GT:JS.Loader.30

Verdict:

Malicious

Labled as:

GT:JS.Loader.30

Link:

https://www.hybrid-analysis.com/sample/832f4c6ca7b9b61b3a8063355c71f96e5b18e1bfd209df3cd3570b55e5144b4f

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-09-20T22:16:00Z UTC

Last seen:

2026-09-22T23:28:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/832f4c6ca7b9b61b3a8063355c71f96e5b18e1bfd209df3cd3570b55e5144b4f/results?tab=lookup

Nucleon Malprob Malware

Score:

91%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/832f4c6ca7b9b61b3a8063355c71f96e5b18e1bfd209df3cd3570b55e5144b4f

Malva.RE

Gathering data

CERT.PL MWDB remcos

Detection:

remcos

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/832f4c6ca7b9b61b3a8063355c71f96e5b18e1bfd209df3cd3570b55e5144b4f/

ReversingLabs TitaniumCloud Win32.Trojan.Malgent

Threat name:

Win32.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-09-21 05:02:43 UTC

File Type:

Text (JavaScript)

AV detection:

10 of 24 (41.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qmxuy3fhxg3bwouamm2vy4pznznrryn72ie56pgtk4fvlziujnhq._file

Threatray Remcos

Verdict:

malicious

Label(s):

Remcos

Alert

Create hunting rule

Link:

https://reports.threatray.com/2fd59a7b-5fce-4883-956c-eda509507aa6

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos botnet:remotehost collection defense_evasion execution rat trojan

Link:

https://tria.ge/reports/260921-fn9j7av16q/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

outlook_office_path

Command and Scripting Interpreter: JavaScript

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Family: Remcos

Process spawned unexpected child process

UAC bypass

Malware Config

C2 Extraction:

91.92.41.153:2404

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.21

Link:

https://yomi.yoroi.company/submissions/832f4c6ca7b9b61b3a8063355c71f96e5b18e1bfd209df3cd3570b55e5144b4f