MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 85508fcc8478cba03aee3434c45853e3887084f48832f53e28da53909a92da14. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 16


Intelligence 16 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 85508fcc8478cba03aee3434c45853e3887084f48832f53e28da53909a92da14
SHA3-384 hash: 2a581be67f79d16d637a607cfd4fa9410f18c25821c99ef03aa589415e44ca41bb9701b8632876595da04565e73f07cd
SHA1 hash: 2a17c2ad6302c1f0d2665a4e042cd4f59eb756fa
MD5 hash: 565feef4eb5f2a13f30434e9392f46db
humanhash: alabama-wisconsin-wolfram-winter
File name:PO#_9071_(Rev-1).exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:860'672 bytes
First seen:2026-05-21 14:29:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'116 x AgentTesla, 20'118 x Formbook, 12'357 x SnakeKeylogger)
ssdeep 12288:MEkbCXbHUjlWhAHoHiYJfZK2VHcqaLUTlgSrDoNhPoOgs/lr1T7bYdvKkyDmmk72:RkbM0jlWA2fZKprLUTl4D0+JI4aX7
TLSH T10E0523C95BEB7F54CCBC03BFA92214F007B0B046A977D6429FE504466F7ABA9850AF05
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter TomU
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
CH CH
Vendor Threat Intelligence
Malware configuration found for:
DeepSea
Details
DeepSea
DeepSea decrypted strings
Link:
https://research.acce.ciphertechsolutions.com/results/e459a86c-30b1-4603-9351-128e2eaff0fb/
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/67352/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a0f221e98070a72bb9c7734
Tags:
crypted shell remo
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a process with a hidden window
Creating a file in the %temp% directory
Launching a process
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Launching a service
Connection attempt to an infection source
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
base64 obfuscated packed reconnaissance remcos
Link:
https://www.filescan.io/uploads/6a0f2009056ea44c453769cd/reports/dd96b1ca-3631-4f70-8688-baae64f42eb0/overview
Verdict:
Malicious
Labled as:
Jalapeno.Generic
Link:
https://www.hybrid-analysis.com/sample/85508fcc8478cba03aee3434c45853e3887084f48832f53e28da53909a92da14
Verdict:
Malicious
File Type:
exe x32
First seen:
2024-09-19T22:01:00Z UTC
Last seen:
2026-05-14T09:55:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/85508fcc8478cba03aee3434c45853e3887084f48832f53e28da53909a92da14/results?tab=lookup
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bb61f4a4-aad3-40b3-972f-c0ce202334cb
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/85508fcc8478cba03aee3434c45853e3887084f48832f53e28da53909a92da14
Gathering data
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/85508fcc8478cba03aee3434c45853e3887084f48832f53e28da53909a92da14/
Threat name:
Win32.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2024-09-20 04:30:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
26 of 36 (72.22%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:3456789 discovery execution persistence rat
Link:
https://tria.ge/reports/260521-rv8r1sfv9n/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Family: Remcos
Malware Config
C2 Extraction:
172.93.220.148:45682
Unpacked files
SH256 hash:
85508fcc8478cba03aee3434c45853e3887084f48832f53e28da53909a92da14
MD5 hash:
565feef4eb5f2a13f30434e9392f46db
SHA1 hash:
2a17c2ad6302c1f0d2665a4e042cd4f59eb756fa
Link:
https://www.unpac.me/results/6ae3edbb-7871-4044-8e87-9eb0c6dcb28c/
SH256 hash:
8b57a0bf569967168f71c65a9a3fea76d712a114ed75bbf2b5fe50009cef7b1d
MD5 hash:
e14b56671ab9359a74544abff82db87e
SHA1 hash:
06f995c44f40d2655cb00f753a791421896e107e
Detections:
win_remcos_auto
Create hunting rule
win_remcos_w0
Create hunting rule
Remcos
Create hunting rule
Link:
https://www.unpac.me/results/6ae3edbb-7871-4044-8e87-9eb0c6dcb28c/
Parent samples :
7815d02dd41dd657438b4b226f4ac1a33d6a37159e34448627088e1354f9ab69
31febdf316e73eaa38c90143a5cd2351cdc4f4921ada4f6b053e5f9c2fa3d752
ee4a689891705260239affa76e606afe4bb0e3100770f0f57a27b6367b0bbb40
b3c084f9fd5fe18129978cccf6d2d2ac972d5c7db3a7378372476f535cc16b8e
a9d403efd3d1d5740a5b1d8a0d691422b4cede106265437f533523f2d7bac16e
cb2b849e4d24527ba41c0e5ae3982ecde5bd91b94b5ae8bb27dc221b4c775891
bb982ea4dad990c5c393a7f1fb85a4daf85be97edcb1e1473cdd0703596ecd6d
cf7d328ce0b9c53b4613030296421f1cc710aa391bca418b3e3566db1128cbe5
165bd5cfc46baeefab886b4375416e2ee062f81ae488a551f5636acdeae1a592
61c1041120dd07b3155a6f3d8a0e5e831b1cb37c5ed2b6acb04eb88e4415c2cd
6a53c56172ce6e29d1ab7e14cbd2ad20069637828cbb8a12d240addcf96dd5bc
85508fcc8478cba03aee3434c45853e3887084f48832f53e28da53909a92da14
c59a535b1a8525c8f5714034085bfa0008e5c4bb55f0c39183c07ac3828a7cdd
SH256 hash:
d1f4761e2e1e15fe454a70864c3aa1da7d6dc90582222bbd7e6d53d0bbee6f62
MD5 hash:
b08a9c9cb485bd7567bf062922a1e897
SHA1 hash:
3b5781fb115d06bdede80cb6ff627fde1a50d9f5
Link:
https://www.unpac.me/results/6ae3edbb-7871-4044-8e87-9eb0c6dcb28c/
Parent samples :
e0c6754a29f3aae510a03bbfc2f03a576fa27bdb4915b35649b357912606fffa
b222db5c481e3e1421f07bd35fe5022b912d3e70214c254a00d9e8ec5c382987
2da496c1cdddd81ca1e452eacc38596132cb62883d8b568ee55e2524a054facd
c30bcd2377714775a591adfba9ffcbc833f646bf9669829acf1d0dd0c07e030d
9c7df3a3e8174fcad51ce98aa8875fd72b8e7acadb309ad8b6ac59e8a0c1d65d
39454a1ce8c389d837bb510efe44858712813fd3ef611822af3a1e5b0f64f52a
b4ea9fc8891fce7e255d583efa962256b0dee44df2de28f0e4d4ae8145f0ca5a
019c0bda2cdb00d88ddd70fae9c57490c14b218aa3c2e9f383f75fa415c03168
00bebcf6a27277b5060ea1264725f496a99b7e5d06649e6e8c9c8ad24055ec61
0787749d9897612314975e2943139157efcff4dbf604323d3d950c76b7555719
SH256 hash:
11171f6e93c13063344e1341a2bff2905f62e13e33b0f04ed273f5046ade871d
MD5 hash:
881a5b569b92061375c2738be2404af0
SHA1 hash:
ef4d6d7588dd2d394f22617f865cfd40781aeb5f
Link:
https://www.unpac.me/results/6ae3edbb-7871-4044-8e87-9eb0c6dcb28c/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/85508fcc8478/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Executable exe 85508fcc8478cba03aee3434c45853e3887084f48832f53e28da53909a92da14

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/67352/

Comments