MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 83c1d48af4f0f6154271dc1f2a0aaeeabe20e22aef5c0d4d3020290d8c89e07e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	83c1d48af4f0f6154271dc1f2a0aaeeabe20e22aef5c0d4d3020290d8c89e07e
SHA3-384 hash:	f8ea8b00b926309c8f9c50a5e70f4ca771eb568f47246c5310f74d94e2417bd4041a8eff01bdee2e3df4b56bd726bd91
SHA1 hash:	4de9e7dab40369151c31d561b7050aa9770c1c07
MD5 hash:	e555d0e5c279cf4054fe999ba6362cba
humanhash:	xray-mountain-orange-pip
File name:	PO520.js
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	15'251 bytes
First seen:	2025-06-18 08:05:50 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	192:Dmyq6eBercy9iBpieBhaK/MMnZWlxP4iOvsgwqVbuw:Dmvf0IAiBRPs0yXzebuw
Threatray	4'136 similar samples on MalwareBazaar
TLSH	T1956284459986C667AD3742A1676DF021F79A0003B279E0A0F4DE97002F74AF28177FCB
Magika	javascript
Reporter	abuse_ch
Tags:	js RemcosRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

346

Origin country :

NL

Vendor Threat Intelligence

CyberFortress

Gathering data

Hybrid Analysis Trojan.Cryxos.JS

Verdict:

Malicious

Labled as:

Trojan.Cryxos.JS

Link:

https://www.hybrid-analysis.com/sample/83c1d48af4f0f6154271dc1f2a0aaeeabe20e22aef5c0d4d3020290d8c89e07e

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1717259

Signature

Bypasses PowerShell execution policy

Connects to a pastebin service (likely for C&C)

Creates autostart registry keys with suspicious values (likely registry only malware)

Found suspicious powershell code related to unpacking or dynamic code loading

Found Tor onion address

JavaScript source code contains functionality to generate code involving HTTP requests or file downloads

Joe Sandbox ML detected suspicious sample

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Malicious Base64 Encoded PowerShell Keywords in Command Lines

Sigma detected: Net WebClient Casing Anomalies

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: PowerShell Base64 Encoded Reflective Assembly Load

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

System process connects to network (likely due to code injection or exploit)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Yara detected Powershell decode and execute

Yara detected Powershell download and execute

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

6%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/83c1d48af4f0f6154271dc1f2a0aaeeabe20e22aef5c0d4d3020290d8c89e07e

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/83c1d48af4f0f6154271dc1f2a0aaeeabe20e22aef5c0d4d3020290d8c89e07e/

ReversingLabs TitaniumCloud Script-JS.Backdoor.Remcos

Threat name:

Script-JS.Backdoor.Remcos

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-06-17 09:29:55 UTC

File Type:

Text (CSharp)

AV detection:

8 of 23 (34.78%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qpa5jcxu6d3bkqtr3qpsucvo5k7cbyrk55oa2tjqeauq3dej4b7a._file

Threatray remcos

Verdict:

malicious

Label(s):

remcos

Alert

Create hunting rule

Similar samples:

01e64e728e9cb3b71936e9e728a60bd347a9255a39b925534f3b6c730626b533

RemcosRAT

081c1e5d1c9c59d76a490b45f7062f9cfbf18fa2e5b77f827a4cfb6a5e48b5c2

RemcosRAT

88baab8266944250a5023bb1cdc5b053becf7c3fbf3e54e7ecbad5f514234eeb

RemcosRAT

9c39d381f96fb45ffcb826c90aaee8c6818767eabf44e757fa5518217611d7c7

RemcosRAT

b254541038b979c1c21f489e21bc15f594492aff656bc908aa54033bafb05775

RemcosRAT

e2f0b9dd0b78dd0a118d56c3606ba1643e1b4f63e7286bee0bb4f37f62266e40

RemcosRAT

e9c8eec1859524e1d0bc49cf7156a0eb867af6d301b6c98ee82c425ab5d12bda

RemcosRAT

error

RemcosRAT

+ 4'126 additional samples on MalwareBazaar

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos botnet:throttle discovery execution persistence rat

Link:

https://tria.ge/reports/250618-j1e3wsywa1/

Behaviour

Modifies registry class

Script User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Adds Run key to start application

Checks computer location settings

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Remcos

Remcos family

Malware Config

C2 Extraction:

172.94.96.245:2025

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/83c1d48af4f0f6154271dc1f2a0aaeeabe20e22aef5c0d4d3020290d8c89e07e