MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8ebd003e1a80ebe1ca3d678c0d308ea45c060c2eeda6771dffe4e3772a1cfd61. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 21


Intelligence 21 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8ebd003e1a80ebe1ca3d678c0d308ea45c060c2eeda6771dffe4e3772a1cfd61
SHA3-384 hash: 4bf1ab7e38151d9ddc53adbf6125e6c1c7045935320577a7d5c7446ae1307becd33258e628e980c4616f9a7c982fe10e
SHA1 hash: d9146bede5116e668ea8f7b357a6b35cc0074025
MD5 hash: b6cfda77bc0d57b579262c154295212d
humanhash: nitrogen-asparagus-happy-charlie
File name:baba.goods.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'004'552 bytes
First seen:2025-11-18 18:56:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'672 x AgentTesla, 19'489 x Formbook, 12'212 x SnakeKeylogger)
ssdeep 24576:VOTjFKekrAa7+6gIMq9wgLoi5VOgjd1/47cn:sTjQjr6OM1C5pd1/hn
Threatray 1'788 similar samples on MalwareBazaar
TLSH T16D2512A51369EA03D0E15F7814B5D3F16772AEC97810D3578AFAECE7BC4A74828442E3
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter James_inthe_box
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
126
Origin country :
US US
Vendor Threat Intelligence
Malware family:
remcos
Create hunting rule
ID:
1
File name:
HBL_pdf.vbs
Verdict:
Malicious activity
Analysis date:
2025-11-18 18:52:28 UTC
Tags:
rat remcos auto-sch-xml
Link:
https://app.any.run/tasks/658945f3-5382-41b7-9a27-cafd2ddfe6b3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/38608/
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=691cc198434cd67b17c2df90
Tags:
injection spawn shell
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Connection attempt
Creating a window
DNS request
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Unauthorized injection to a recently created process
Restart of the analyzed sample
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
expired-cert invalid-signature packed signed
Link:
https://www.filescan.io/uploads/691cc195d7c81eabf165b56c/reports/349a21dd-49a4-42ce-ab47-f50b1ee10615/overview
Verdict:
Malicious
Labled as:
Genie8DN.Generic
Link:
https://www.hybrid-analysis.com/sample/8ebd003e1a80ebe1ca3d678c0d308ea45c060c2eeda6771dffe4e3772a1cfd61
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-11-18T15:41:00Z UTC
Last seen:
2025-11-18T17:11:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan.MSIL.Taskun.sb PDM:Trojan.Win32.Generic HEUR:Trojan-PSW.MSIL.Agensla.gen Trojan.MSIL.Taskun.sb Trojan.MSIL.Inject.sb
Link:
https://opentip.kaspersky.com/8ebd003e1a80ebe1ca3d678c0d308ea45c060c2eeda6771dffe4e3772a1cfd61/results?tab=lookup
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/eb41d74b-9e9f-4d6f-8760-a2e4e955588b
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/8ebd003e1a80ebe1ca3d678c0d308ea45c060c2eeda6771dffe4e3772a1cfd61
Gathering data
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/8ebd003e1a80ebe1ca3d678c0d308ea45c060c2eeda6771dffe4e3772a1cfd61/
Verdict:
Malicious
Threat:
Family.REMCOS
Link:
https://tip.neiki.dev/file/8ebd003e1a80ebe1ca3d678c0d308ea45c060c2eeda6771dffe4e3772a1cfd61
Threat name:
ByteCode-MSIL.Trojan.Darkcloud
Create hunting rule
Status:
Malicious
First seen:
2025-11-18 18:56:43 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=r26qapq2qdv6dsr5m6ga2meouroamdbo5wthohp74trxokq47vqq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
unc_loader_078
Create hunting rule
unc_loader_037
Create hunting rule
Similar samples:
18b2c9711740a6bc733cd4b1000c563905eacc7c698e946f31c69cf90a0ab0bf
RemcosRAT
5775f78e49d3cc327678941c043fb5df1f79183482fbc4782a02e811ba8732d4
RemcosRAT
8ebd003e1a80ebe1ca3d678c0d308ea45c060c2eeda6771dffe4e3772a1cfd61
RemcosRAT
dc525ff2c6684650c58def96f89d3e372f3d7082e36e41fdf1acf6a530236d97
RemcosRAT
ead9f443d43e6c9548964721edbf937b1cdf9b5d6126682714de2aba4a086078
RemcosRAT
error
RemcosRAT
+ 1'778 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:ip add @ thales3033 discovery execution persistence rat
Link:
https://tria.ge/reports/251118-xl41csar8t/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Remcos
Remcos family
Malware Config
C2 Extraction:
77.110.98.159:3033
thales3033.com:3033
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/21f9d6dd-9d9e-46e9-9080-e881acdfdfda
Unpacked files
SH256 hash:
8ebd003e1a80ebe1ca3d678c0d308ea45c060c2eeda6771dffe4e3772a1cfd61
MD5 hash:
b6cfda77bc0d57b579262c154295212d
SHA1 hash:
d9146bede5116e668ea8f7b357a6b35cc0074025
Link:
https://www.unpac.me/results/4af86f6e-de45-4413-9f28-727b29cb7167/
SH256 hash:
0748253bb84d8fd3277d926bee9aae97560c37921ccb3d1dbf3199fae3e62a20
MD5 hash:
0b2dd04f55951e3d7e42268c47161128
SHA1 hash:
1b4cd4e9944032fe88cac5dc0c5fc46d2189b327
Link:
https://www.unpac.me/results/4af86f6e-de45-4413-9f28-727b29cb7167/
SH256 hash:
73dee137201978dc991e29303bd218c58c2a53f3d5d704facb498fa6e3ff80fa
MD5 hash:
56cc70a448304d22ce52354a5aea0456
SHA1 hash:
56b309dc3daa12bf1595571dd1729421599461cd
Detections:
win_remcos_w0
Create hunting rule
win_remcos_auto
Create hunting rule
Remcos
Create hunting rule
malware_windows_remcos_rat
Create hunting rule
win_remcos_rat_unpacked
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Link:
https://www.unpac.me/results/4af86f6e-de45-4413-9f28-727b29cb7167/
Parent samples :
8ebd003e1a80ebe1ca3d678c0d308ea45c060c2eeda6771dffe4e3772a1cfd61
4426926529e5a8542f58cf5593881c4bd3fdc2f89200832a74db095fabf6d91f
SH256 hash:
1c5d9464a079144ed3f403322ea7b0f7f75e15964325b292851101af4ecdbe12
MD5 hash:
fa1a48a9b77abdc8fb9e59fab5e02808
SHA1 hash:
a0f39971ad1c68235a271af459664d9ba588c78b
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/4af86f6e-de45-4413-9f28-727b29cb7167/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8ebd003e1a80/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8ebd003e1a80ebe1ca3d678c0d308ea45c060c2eeda6771dffe4e3772a1cfd61

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438
Create hunting rule
Author:ditekSHen
Description:Detects executables signed with stolen, revoked or invalid certificates
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/38608/

Comments