MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8f6f2ba596f74c52c2eec113acc0524898751c4706b1223a16f1c7189840cba9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 20


Intelligence 20 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8f6f2ba596f74c52c2eec113acc0524898751c4706b1223a16f1c7189840cba9
SHA3-384 hash: 3153e70c1c7309dad2e89e2e8dfea3746c3b4e9b4f209271370dc34f59ce725831e3b5b0bd3853f0c81fe387da5a0428
SHA1 hash: 70899f699d0cc032667047d0c467a2d3e33f30ed
MD5 hash: 99869c46c25c87ad04caae5d09342dfe
humanhash: bakerloo-mexico-bluebird-mango
File name:8f6f2ba596f74c52c2eec113acc0524898751c4706b1223a16f1c7189840cba9
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:947'712 bytes
First seen:2025-11-06 10:42:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'667 x AgentTesla, 19'481 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 24576:E07AfgGxI3snM9COQLRgcNbqBcr5e/FkTUvFC:E0ApG3HCOQegqW4FkTU
Threatray 4'060 similar samples on MalwareBazaar
TLSH T11B1512582605C62AC9616BB85E71F2701728ADEDD822C5175FDD7EFBF8B2B109C807C2
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
remcos
Create hunting rule
ID:
1
File name:
8f6f2ba596f74c52c2eec113acc0524898751c4706b1223a16f1c7189840cba9
Verdict:
Malicious activity
Analysis date:
2025-11-06 15:00:49 UTC
Tags:
rat remcos auto-sch-xml remote
Link:
https://app.any.run/tasks/18476fcd-6b22-4f7e-9549-b0f958015fbd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/35848/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=690c7bd5ea0f3e915c238343
Tags:
spawn shell msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Creating a window
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Launching a process
Restart of the analyzed sample
Adding an exclusion to Microsoft Defender
Gathering data
Verdict:
Malicious
Labled as:
Genie.8DN.Generic
Link:
https://www.hybrid-analysis.com/sample/8f6f2ba596f74c52c2eec113acc0524898751c4706b1223a16f1c7189840cba9
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-10-16T04:16:00Z UTC
Last seen:
2025-11-08T00:11:00Z UTC
Hits:
~100
Detections:
PDM:Trojan.Win32.Generic Trojan.MSIL.Taskun.sb Backdoor.Win32.Remcos.sb Backdoor.Win32.Remcos.f Backdoor.Remcos.HTTP.C&C Trojan.MSIL.Inject.sb Trojan.MSIL.Crypt.sb HEUR:Trojan-Spy.MSIL.Noon.gen HEUR:Trojan.MSIL.Taskun.sb Exploit.Win32.BypassUAC.sb
Link:
https://opentip.kaspersky.com/8f6f2ba596f74c52c2eec113acc0524898751c4706b1223a16f1c7189840cba9/results?tab=lookup
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/85cd9d3b-8f69-4430-995d-32fff8e56910
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/8f6f2ba596f74c52c2eec113acc0524898751c4706b1223a16f1c7189840cba9
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.42 Win 32 Exe x86
Link:
https://app.malva.re/file/99869c46c25c87ad04caae5d09342dfe
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/8f6f2ba596f74c52c2eec113acc0524898751c4706b1223a16f1c7189840cba9/
Verdict:
Malicious
Threat:
Family.REMCOS
Link:
https://tip.neiki.dev/file/8f6f2ba596f74c52c2eec113acc0524898751c4706b1223a16f1c7189840cba9
Threat name:
Win32.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2025-10-17 12:52:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
12
AV detection:
26 of 36 (72.22%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=r5xsxjmw65gffqxoyej2zqcsjcmhkhcha2yseoqw6hdrrgcazouq._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
unc_loader_037
Create hunting rule
Similar samples:
3093077e390786c3463e88ea9520a2423102c90486b250fad40105fbad16285e
RemcosRAT
4edeb50b9b757b95e352d4f67827c2e9b32dad7574eaa2438d38822e0cdff459
RemcosRAT
a375f14f98fb9a4242cc2528e0cc369542a197f8ed545a9c6cb445370b00ff29
RemcosRAT
b020144dfab196ac6ddaa6442884f16734746cf346b859cee50660fbb938271f
RemcosRAT
error
RemcosRAT
+ 4'050 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost discovery execution persistence rat
Link:
https://tria.ge/reports/251106-msd3eaznd1/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Remcos
Remcos family
Malware Config
C2 Extraction:
127.0.0.1:29444
nnamoograce.duckdns.org:29444
196.251.92.69:29444
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/3508184b-9f1e-421d-b9c6-505e0fc2d1d3
Unpacked files
SH256 hash:
8f6f2ba596f74c52c2eec113acc0524898751c4706b1223a16f1c7189840cba9
MD5 hash:
99869c46c25c87ad04caae5d09342dfe
SHA1 hash:
70899f699d0cc032667047d0c467a2d3e33f30ed
Link:
https://www.unpac.me/results/9ae9758b-a129-4d01-b19b-47ae9f78225d/
SH256 hash:
b794ed0c0c7d4499d0a2ffff67eb5b92dba83f4be7964591e9edad2755176511
MD5 hash:
2a576318d07470206dd7c45f7d896078
SHA1 hash:
3096b2a5ccd98583949a9f57842d5547b50bbc29
Link:
https://www.unpac.me/results/9ae9758b-a129-4d01-b19b-47ae9f78225d/
SH256 hash:
4e6ef3dcb91d865cbc2f506f85e30454f0949ac8290d2466faef72b375fc7625
MD5 hash:
ca6867309400c99bf91238b961582b72
SHA1 hash:
47d75742a986704fdfec0f0ed79396d0e0e4c462
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/9ae9758b-a129-4d01-b19b-47ae9f78225d/
SH256 hash:
e31070383ff8593d70c33a8ed41a879000232052faff6317fb5cf5c613625e03
MD5 hash:
fd412077148220dbe0943548ccd3ca61
SHA1 hash:
fd60216d876d23cc094db869665098e78f9e3fb4
Detections:
win_remcos_w0
Create hunting rule
win_remcos_auto
Create hunting rule
Remcos
Create hunting rule
malware_windows_remcos_rat
Create hunting rule
win_remcos_rat_unpacked
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Link:
https://www.unpac.me/results/9ae9758b-a129-4d01-b19b-47ae9f78225d/
Parent samples :
6e13f5c8ca7758d00a49978541775a5c4c6f507b060c473482fbecb190fd0d9c
3cae17dc6bd7706ab2ff54ce1572604f701548eb64f2aa7b2d0d1dd483652720
89cb758105194d9f5bc46ce275d0dbebdafccd523c864064b01804b5667d2aa2
8f6f2ba596f74c52c2eec113acc0524898751c4706b1223a16f1c7189840cba9
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8f6f2ba596f7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8f6f2ba596f74c52c2eec113acc0524898751c4706b1223a16f1c7189840cba9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/35848/

Comments