🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 90cfcd4d67f0df0631f2bc7493c38c00064e72704b9442b4f6cdea99d867ae31. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 90cfcd4d67f0df0631f2bc7493c38c00064e72704b9442b4f6cdea99d867ae31
SHA3-384 hash: f1d42e627d1e58729fa4184a24c23788f719647a5e5fd862e937b6dac0309157fcca474758430e9b6b7801b56b20641e
SHA1 hash: 35e4a4cc36290c003f3742f22ebe1a2f6f07ec56
MD5 hash: f6a9cf4652cc23ddb6a9069853cd5f6f
humanhash: monkey-sweet-india-item
File name:ArrivalXNotice.rar
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:14'981 bytes
First seen:2026-10-14 15:19:45 UTC
Last seen:2026-10-14 15:21:04 UTC
File type: rar
MIME type:application/vnd.rar
ssdeep 384:aCijEjIY73JiSZrTXZOU5SwSl8PIOr1R7YZrKI29PPFLTZNdF3WOSG:rUO3JPRpepHOr1ECHHNRF
TLSH T12C62C0FA89AD579905E68B7F90A665930F4974BCB8A66380F37C0C4650298F670FD104
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika rar
Reporter TomU
Tags:rar RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
53
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:Arrival Notice.vbe
File size:28'354 bytes
SHA256 hash: cfc532b527f296194a8c4526b73d2ad98982e00ac56e61bc48739d6dd2068374
MD5 hash: 6286890b50e69a08e3e83137c1a779e0
MIME type:text/plain
Signature RemcosRAT
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/5fb0671b-1088-4840-b8ea-f53b7b9e7768/
Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad14db76f551121ba165b2f
Tags:
virus sage
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cmd lolbin obfuscated
Link:
https://www.filescan.io/uploads/6acf9dd70ddf906851a8f79c/reports/dd9a8a07-f461-470b-88b0-b5bc2ef74963/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/90cfcd4d67f0df0631f2bc7493c38c00064e72704b9442b4f6cdea99d867ae31
Verdict:
Malicious
File Type:
rar
First seen:
2026-09-20T12:58:00Z UTC
Last seen:
2026-10-15T00:59:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/90cfcd4d67f0df0631f2bc7493c38c00064e72704b9442b4f6cdea99d867ae31/results?tab=lookup
Verdict:
Malware
YARA:
1 match(es)
Tags:
COM Behavior Trace DeObfuscated Obfuscated Rar Archive SOS: 0.36 T1027 T1059.005 VBScript WScript.Shell
Link:
https://app.malva.re/file/f6a9cf4652cc23ddb6a9069853cd5f6f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/90cfcd4d67f0df0631f2bc7493c38c00064e72704b9442b4f6cdea99d867ae31/
Threat name:
Script-WScript.Trojan.GuLoader
Create hunting rule
Status:
Malicious
First seen:
2026-09-20 19:09:33 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
10 of 23 (43.48%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sdh42tlh6dpqmmpsxr2jhq4maade44tqjokefnhwzxvjtwdhvyyq._file
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:guloader family:remcos botnet:remotehost defense_evasion discovery downloader execution privilege_escalation rat
Link:
https://tria.ge/reports/261014-s3zprae16x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Executes a command shell one-liner
System Location Discovery: System Language Discovery
Executes a VBScript file via the Windows Script Host.
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Contacts third-party web service commonly abused for C2
Checks computer location settings
Badlisted process makes network request
Family: Guloader,Cloudeye
Family: Remcos
Malware Config
C2 Extraction:
103.83.86.178:2404
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/90cfcd4d67f0df0631f2bc7493c38c00064e72704b9442b4f6cdea99d867ae31

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cerberus
Create hunting rule
Author:Jean-Philippe Teissier / @Jipe_
Description:Cerberus
Rule name:detect_tiny_vbs
Create hunting rule
Author:daniyyell
Description:Detects tiny VBS delivery technique

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar 90cfcd4d67f0df0631f2bc7493c38c00064e72704b9442b4f6cdea99d867ae31

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments