MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 97272d6e3dcecb5d0269b1775ce2aca97670d4991bd7e43379d565bae2fc095f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	97272d6e3dcecb5d0269b1775ce2aca97670d4991bd7e43379d565bae2fc095f
SHA3-384 hash:	76d3d47e04ed9a3816a9113ae1c54f9e57a74d4548dfb5d1375f667fc685d1e4eddb32209c417b7cea9890b1950c80ec
SHA1 hash:	fe31319dabe7f49809eba7f51518a39d3aeadadb
MD5 hash:	fe74edf558c2336b7f2b2c99d9a6ac35
humanhash:	music-black-friend-eight
File name:	Ponuda 317258 HM Frankstahl d.o.o. 07-16-2026.bat
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	3'308 bytes
First seen:	2026-07-20 07:51:50 UTC
Last seen:	Never
File type:	bat
MIME type:	text/plain
ssdeep	96:eXJi8H97BQJmf2oj0j9agiYPOWNvRH02JXFIuL:SJi8Hwmf2KU9agIWZRH02JXbL
TLSH	T1006163139DA1ACE360EB196050CB6F4591ED7B9129A138CC5777CB720F2F54807AAACE
Magika	powershell
Reporter	lowmal3
Tags:	bat RemcosRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

85

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ANY.RUN remcos

Malware family:

remcos

Alert

Create hunting rule

ID:

1

File name:

FW Ponuda 317258 HM Frankstahl d.o.o. 07-16-2026.msg

Verdict:

Malicious activity

Analysis date:

2026-07-20 06:37:36 UTC

Tags:

arch-exec attc-arch susp-attachments attachments attc-unc remcos rat stealer

Link:

https://app.any.run/tasks/2f9757a3-f6cd-4d27-8ddf-a12f0dc268b9

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/75269/

CyberFortress Malicious

Verdict:

Malicious

Score:

94.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a5dd3c0bcffb2c48cb79d0f

Tags:

xtreme shell sage

Dr. Web vxCube Suspicious

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Launching a process

Creating a file in the system32 directory

DNS request

Connection attempt

Sending a custom TCP request

Sending an HTTP GET request

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

base64 crypto downloader encrypted powershell

Link:

https://www.filescan.io/uploads/6a5dd3be33d19efd891e684c/reports/c2da6356-95fa-40c7-925a-18f11f54cf70/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/97272d6e3dcecb5d0269b1775ce2aca97670d4991bd7e43379d565bae2fc095f

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

ps1

First seen:

2026-07-16T05:27:00Z UTC

Last seen:

2026-07-22T03:22:00Z UTC

Hits:

~1000

Detections:

Trojan.BAT.Agent.gin

Link:

https://opentip.kaspersky.com/97272d6e3dcecb5d0269b1775ce2aca97670d4991bd7e43379d565bae2fc095f/results?tab=lookup

Joe Sandbox GuLoader

Result

Threat name:

GuLoader

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1945083

Signature

Antivirus detection for URL or domain

Found suspicious powershell code related to unpacking or dynamic code loading

Hides threads from debuggers

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Potential PowerShell Command Line Obfuscation

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Writes to foreign memory regions

Yara detected GuLoader

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/97272d6e3dcecb5d0269b1775ce2aca97670d4991bd7e43379d565bae2fc095f

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/97272d6e3dcecb5d0269b1775ce2aca97670d4991bd7e43379d565bae2fc095f/

ReversingLabs TitaniumCloud Script-PowerShell.Trojan.GuLoader

Threat name:

Script-PowerShell.Trojan.GuLoader

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-16 13:53:07 UTC

File Type:

Text (PowerShell)

AV detection:

12 of 38 (31.58%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=s4ts23r5z3fv2atjwf3vzyvmvf3hbvezdpl6im3z2vs3vyx4bfpq._file

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos botnet:32 collection defense_evasion discovery execution persistence rat trojan

Link:

https://tria.ge/reports/260720-jqqrmsdv3z/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

Executes a command shell one-liner

System Location Discovery: System Language Discovery

Hide Artifacts: Ignore Process Interrupts

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses Microsoft Outlook profiles

Adds Run key to start application

Badlisted process makes network request

Family: Remcos

UAC bypass

Malware Config

C2 Extraction:

red64.duckdns.org:51842
red64bk.duckdns.org:50810

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/97272d6e3dcecb5d0269b1775ce2aca97670d4991bd7e43379d565bae2fc095f

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

bat 97272d6e3dcecb5d0269b1775ce2aca97670d4991bd7e43379d565bae2fc095f

(this sample)

  

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/75269/