MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8d7fae9ec5139cb7a184710ac445ebf16aeca23fd38c33eae63a2ff351570fd4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	8d7fae9ec5139cb7a184710ac445ebf16aeca23fd38c33eae63a2ff351570fd4
SHA3-384 hash:	be1108e916f0b740e871ee41b710a6f2e9b75f4eab274b4576317caa59428b35f3ceefab36c00ce3f0e8b766ac2fec5b
SHA1 hash:	56271690e079ce130ba96a067975662a3fb94664
MD5 hash:	dc2f11905c77929a9b115bb02b3640fb
humanhash:	enemy-sierra-nitrogen-texas
File name:	05002600357104880_KAWAN_LAMA_GROUP_PT.Gz
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	26'435 bytes
First seen:	2026-10-29 04:55:17 UTC
Last seen:	Never
File type:	gz
MIME type:	application/gzip
ssdeep	768:Nok3zaaf4vy+zbesbY/W+Yh7UV/GpqDa18XP:tjaaf46AeEY+lZUNG/8XP
TLSH	T1FFC2E17DB21CCBEE2A6A5D0A0797BF09E52149F0BDD636111768D9A9909CCB3CC02E4C
Magika	gzip
Reporter	qemped
Tags:	gz malspam RemcosRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

78

Origin country :

ID

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	05002600357104880_KAWAN_LAMA_GROUP_PT.js
File size:	127'838 bytes
SHA256 hash:	4f1dcf5f02913db699db8e9d138e2cca9d7e7657d7d9bb37c6eef23ab794b22f
MD5 hash:	b681cefbb5176dd82549e3e607babd54
MIME type:	text/plain
Signature	RemcosRAT

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.GZip_js.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ae2d1bbb175ade21dce7b1f

Tags:

dropper cryxos xtreme virus

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

repaired

Link:

https://www.filescan.io/uploads/6ae2d1edc1657a4ad1725fdb/reports/389e467c-7689-44cf-ae29-a9419607553f/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/8d7fae9ec5139cb7a184710ac445ebf16aeca23fd38c33eae63a2ff351570fd4

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

gz

First seen:

2026-10-29T00:00:00Z UTC

Last seen:

2026-10-30T07:29:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/8d7fae9ec5139cb7a184710ac445ebf16aeca23fd38c33eae63a2ff351570fd4/results?tab=lookup

Nucleon Malprob Susipicious

Score:

54%

Verdict:

Susipicious

File Type:

ARCHIVE

Link:

https://malprob.io/report/8d7fae9ec5139cb7a184710ac445ebf16aeca23fd38c33eae63a2ff351570fd4

Malva.RE Malware

Verdict:

Malware

YARA:

1 match(es)

Tags:

GZip Archive JS Emulation Trace Scripting.FileSystemObject T1059.007 WScript.Shell

Link:

https://app.malva.re/file/dc2f11905c77929a9b115bb02b3640fb

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8d7fae9ec5139cb7a184710ac445ebf16aeca23fd38c33eae63a2ff351570fd4/

ReversingLabs TitaniumCloud Script-JS.Backdoor.Remcos

Threat name:

Script-JS.Backdoor.Remcos

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-10-29 03:52:19 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

11 of 24 (45.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rv725hwfcoolpimeoefmirpl6fvozir72ogdh2xghix7gukxb7ka._file

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos botnet:oct_milli collection credential_access discovery execution rat stealer

Link:

https://tria.ge/reports/261029-gw7agaw1et/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

outlook_office_path

Browser Information Discovery

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

System Time Discovery

Drops file in Program Files directory

Drops file in Windows directory

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Loads dropped DLL

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Uses browser remote debugging

Family: Remcos

Process spawned unexpected child process

Malware Config

C2 Extraction:

magicalplanet.4nmn.com:4607

Dropper Extraction:

https://white-band-a6fb.to-o-ls-mee.workers.dev/qwkkedr

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.70

Link:

https://yomi.yoroi.company/submissions/8d7fae9ec5139cb7a184710ac445ebf16aeca23fd38c33eae63a2ff351570fd4