MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8765f214c14f45783e4e25d808f87a84cdfebebfb5e3480f4e44f043f2d00713. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	8765f214c14f45783e4e25d808f87a84cdfebebfb5e3480f4e44f043f2d00713
SHA3-384 hash:	ca9c6763b1d2f79cc9f567fe9e0b684b3bec250f1a362577bfbf743be1c60d1dc67e9bfddeba1181cca835865c3893af
SHA1 hash:	4496bb59bcc465d060f7e6cb38610df3c9008fda
MD5 hash:	6a89d5fe905b1c226edc42b382f94d08
humanhash:	quiet-march-cat-mobile
File name:	INV35 INV38.vbs
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	26'884 bytes
First seen:	2026-07-17 09:52:37 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	768:RJPA4WMPvJujcqwWve4JP9Bdv0i1BCNHZ5lgJDOsy1oiB:knANK3JP9Bl0i1BCN5HgJDOtB
TLSH	T191C21862BF4105534ECBB6A2CA7CCF2B9DA4E9914531BC60ADFC3B19C845B0C367D51A
Magika	vba
Reporter	threatcat_ch
Tags:	RemcosRAT vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

90

Origin country :

CH

Vendor Threat Intelligence

ACCE Unknown

No detections

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/74988/

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Obfus-172.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a59fbe5b3055706bb55821f

Tags:

obfuscated obfuscate xtreme

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

evasive

Link:

https://www.filescan.io/uploads/6a59fb97d2e63c157226cae5/reports/3ce0d39b-94a1-4820-9c3c-a7e880932dc1/overview

Hybrid Analysis VBS/Agent.QMG trojan

Verdict:

Malicious

Labled as:

VBS/Agent.QMG trojan

Link:

https://www.hybrid-analysis.com/sample/8765f214c14f45783e4e25d808f87a84cdfebebfb5e3480f4e44f043f2d00713

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

vbs

First seen:

2026-07-17T04:57:00Z UTC

Last seen:

2026-07-19T08:40:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/8765f214c14f45783e4e25d808f87a84cdfebebfb5e3480f4e44f043f2d00713/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1944124

Signature

Found suspicious powershell code related to unpacking or dynamic code loading

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Potential malicious VBS script found (suspicious strings)

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

VBScript performs obfuscated calls to suspicious functions

Windows Scripting host queries suspicious COM object (likely to drop second stage)

WScript reads language and country specific registry keys (likely country aware script)

Wscript starts Powershell (via cmd or directly)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/8765f214c14f45783e4e25d808f87a84cdfebebfb5e3480f4e44f043f2d00713

Malva.RE Malware

Verdict:

Malware

YARA:

1 match(es)

Tags:

Scripting.FileSystemObject Shell.Application T1059.005 VBScript

Link:

https://app.malva.re/file/6a89d5fe905b1c226edc42b382f94d08

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8765f214c14f45783e4e25d808f87a84cdfebebfb5e3480f4e44f043f2d00713/

ReversingLabs TitaniumCloud Win32.Trojan.Znyonm

Threat name:

Win32.Trojan.Znyonm

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-17 08:38:24 UTC

File Type:

Text (VBS)

AV detection:

11 of 24 (45.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=q5s7efgbj5cxqpsoexmar6d2qtg75pv7wxruqd2oityeh4wqa4jq._file

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos botnet:remotehost collection discovery rat

Link:

https://tria.ge/reports/260717-lwwwysgw6r/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses Microsoft Outlook profiles

Contacts third-party web service commonly abused for C2

Checks computer location settings

Badlisted process makes network request

Family: Remcos

Malware Config

C2 Extraction:

102.220.160.104:2404

VMRay Remcos

Malware family:

Remcos

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/8765f214c14f/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8765f214c14f45783e4e25d808f87a84cdfebebfb5e3480f4e44f043f2d00713

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

vbs 8765f214c14f45783e4e25d808f87a84cdfebebfb5e3480f4e44f043f2d00713

(this sample)

  

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/74988/