MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8ae20a166e6b2ab746c2f97d92967b6df83c85d6cd81acab1a4883638c5dde92. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8ae20a166e6b2ab746c2f97d92967b6df83c85d6cd81acab1a4883638c5dde92
SHA3-384 hash: b45f420508409d345d96ebbee921639ecb1a5a7af6e953a11fb8c71abc4eb051bb192dadfcba791c5fc7852d3a823b02
SHA1 hash: 41cfe3dd052cd4edc497bfc6b0b94ee88d3731bc
MD5 hash: 8fb3db11447678753ec8ba9a9711e51d
humanhash: vermont-batman-tennis-dakota
File name:EUROPA ANFRAGE E261138 A001 PRODUKT DIENSTLEISTUNG SPEZIFIKATIONEN.js
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:763'280 bytes
First seen:2026-06-22 08:46:03 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 3072:9XSRIOkIeSRIOkIQGhj3SRIOkIQGt8SRIOkZSR2SRIHSRIBhmoSRIOkIQGhuSRIY:Ebs1Jr91dV9qdij3XIAziD516Vqx2AQ
TLSH T15FF45B20DD25076E0F4717AAFC955B62CA7CC909562611F5FADE0B4D62028FCE3BF628
Magika javascript
Reporter lowmal3
Tags:js RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
163
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Win32.SuspectCrc.5523.2058.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a38f67a1548daf709f8cd9a
Tags:
n/a
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
fingerprint repaired
Link:
https://www.filescan.io/uploads/6a38f67090632a45f731b64a/reports/82968f05-8be9-40e0-a0f2-ac37d5ce1a4a/overview
Verdict:
Suspicious
Labled as:
Trojan/JS.GuLoader
Link:
https://www.hybrid-analysis.com/sample/8ae20a166e6b2ab746c2f97d92967b6df83c85d6cd81acab1a4883638c5dde92
Verdict:
Malicious
File Type:
js
First seen:
2026-06-22T02:50:00Z UTC
Last seen:
2026-06-24T07:32:00Z UTC
Hits:
~1000
Detections:
Trojan.VBS.SAgent.sb HEUR:Trojan.Script.SAgent.gen HEUR:Trojan.Script.Generic Trojan.PowerShell.Strion.sb PDM:Trojan.Win32.Generic
Link:
https://opentip.kaspersky.com/8ae20a166e6b2ab746c2f97d92967b6df83c85d6cd81acab1a4883638c5dde92/results?tab=lookup
Result
Threat name:
Remcos, GuLoader
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1931671
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Creates processes via WMI
Detected Remcos RAT
Found hidden mapped module (file has been removed from disk)
Found malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
JavaScript source code contains functionality to generate code involving a shell, file or stream
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Obfuscated command line found
Sigma detected: Remcos
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Unusual module load detection (module proxying)
Uses dynamic DNS services
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected GuLoader
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1931671 Sample: EUROPA ANFRAGE E261138 A001... Startdate: 22/06/2026 Architecture: WINDOWS Score: 100 71 animal342.duckdns.org 2->71 73 tu.feyhaum.com 2->73 79 Suricata IDS alerts for network traffic 2->79 81 Found malware configuration 2->81 83 Malicious sample detected (through community Yara rule) 2->83 87 11 other signatures 2->87 9 powershell.exe 18 2->9         started        12 wscript.exe 1 1 2->12         started        14 powershell.exe 2->14         started        16 2 other processes 2->16 signatures3 85 Uses dynamic DNS services 71->85 process4 dnsIp5 115 Obfuscated command line found 9->115 117 Writes to foreign memory regions 9->117 119 Found suspicious powershell code related to unpacking or dynamic code loading 9->119 121 Switches to a custom stack to bypass stack traces 9->121 19 backgroundTaskHost.exe 6 10 9->19         started        24 backgroundTaskHost.exe 9->24         started        26 conhost.exe 9->26         started        123 Wscript starts Powershell (via cmd or directly) 12->123 125 Windows Scripting host queries suspicious COM object (likely to drop second stage) 12->125 127 Suspicious execution chain found 12->127 129 Creates processes via WMI 12->129 28 powershell.exe 14 16 12->28         started        30 powershell.exe 14->30         started        32 conhost.exe 14->32         started        69 127.0.0.1 unknown unknown 16->69 34 powershell.exe 16->34         started        36 conhost.exe 16->36         started        signatures6 process7 dnsIp8 75 animal342.duckdns.org 138.199.59.5, 49713, 49714, 53522 CDNEXTGB Poland 19->75 63 C:\Users\user\AppData\Local\Temp\TH35CB.tmp, MS-DOS 19->63 dropped 65 C:\Users\user\AppData\Local\Temp\TH359B.tmp, MS-DOS 19->65 dropped 67 C:\Users\user\AppData\Local\Temp\TH356B.tmp, MS-DOS 19->67 dropped 89 Detected Remcos RAT 19->89 91 Writes to foreign memory regions 19->91 93 Maps a DLL or memory area into another process 19->93 38 userinit.exe 1 19->38         started        41 userinit.exe 1 19->41         started        43 userinit.exe 19->43         started        55 4 other processes 19->55 95 Found hidden mapped module (file has been removed from disk) 24->95 97 Unusual module load detection (module proxying) 24->97 99 Switches to a custom stack to bypass stack traces 24->99 77 tu.feyhaum.com 198.71.59.189, 443, 49701, 49712 IONOS-ASThisisthejointnetworkforIONOSFasthostsArsys11MailandMediaand11TelecomFormerlyknownas11InternetSEDE United States 28->77 101 Found suspicious powershell code related to unpacking or dynamic code loading 28->101 45 conhost.exe 28->45         started        47 backgroundTaskHost.exe 30->47         started        49 backgroundTaskHost.exe 30->49         started        51 backgroundTaskHost.exe 34->51         started        53 backgroundTaskHost.exe 34->53         started        file9 signatures10 process11 signatures12 103 Tries to steal Instant Messenger accounts or passwords 38->103 105 Tries to steal Mail credentials (via file / registry access) 38->105 107 Tries to harvest and steal browser information (history, passwords, etc) 41->107 109 Tries to steal Mail credentials (via file registry) 43->109 111 Unusual module load detection (module proxying) 43->111 113 Detected Remcos RAT 47->113 57 backgroundTaskHost.exe 47->57         started        59 conhost.exe 55->59         started        61 reg.exe 1 1 55->61         started        process13
Score:
90%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/8ae20a166e6b2ab746c2f97d92967b6df83c85d6cd81acab1a4883638c5dde92
Verdict:
inconclusive
YARA:
1 match(es)
Link:
https://app.malva.re/file/8fb3db11447678753ec8ba9a9711e51d
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/8ae20a166e6b2ab746c2f97d92967b6df83c85d6cd81acab1a4883638c5dde92/
Verdict:
Malicious
Threat:
Family.REMCOS
Link:
https://tip.neiki.dev/file/8ae20a166e6b2ab746c2f97d92967b6df83c85d6cd81acab1a4883638c5dde92
Threat name:
Script-JS.Trojan.GuLoader
Create hunting rule
Status:
Malicious
First seen:
2026-06-22 08:46:50 UTC
File Type:
Text
AV detection:
6 of 24 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rlrauftonmvlorwc7f6zfft3nx4dzbowzwa2zky2jcbwhdc532ja._file
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:animal collection discovery execution persistence rat
Link:
https://tria.ge/reports/260622-kpmt2aa15x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
Command and Scripting Interpreter: JavaScript
System Location Discovery: System Language Discovery
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Accesses Microsoft Outlook profiles
Adds Run key to start application
Badlisted process makes network request
Detected Nirsoft tools
Family: Remcos
Process spawned unexpected child process
Malware Config
C2 Extraction:
animal342.duckdns.org:53522
animal342bk.duckdns.org:60507
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8ae20a166e6b2ab746c2f97d92967b6df83c85d6cd81acab1a4883638c5dde92

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Java Script (JS) js 8ae20a166e6b2ab746c2f97d92967b6df83c85d6cd81acab1a4883638c5dde92

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments