MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 999d567fa7c54493dff984905511d54b94c7d0d6c8034994108ef387cd433946. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 19


Intelligence 19 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 999d567fa7c54493dff984905511d54b94c7d0d6c8034994108ef387cd433946
SHA3-384 hash: ee97cc4361ba87491e35dd2146fca191b2d3a1a145b3266a878809a3caa1ffaff932c851b738dbdb79dd1a76e67fcb30
SHA1 hash: 347455cc3aae93e4a5322785675bb3d535994199
MD5 hash: 9ff6d2bec74148c875392bc578ffd2af
humanhash: neptune-uranus-fifteen-bulldog
File name:999d567fa7c54493dff984905511d54b94c7d0d6c8034994108ef387cd433946
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'185'280 bytes
First seen:2025-07-31 11:28:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'738 x AgentTesla, 19'596 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 24576:A+4jGYwplYzKE9+ZcxzL7hWsHOF7n9CWR/pzWA:N4jGYwDk9OcxVHE79zRx6A
Threatray 4'119 similar samples on MalwareBazaar
TLSH T1BE45ADE06354DB51C4BA53F81432E67357B36E5EAC29D20E2CC2BEDB3D717820522A97
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon 6cecccccb4c2f2b2 (38 x AgentTesla, 30 x Formbook, 24 x PythonStealer)
Reporter JAMESWT_WT
Tags:exe RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
56
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
remcos
Create hunting rule
ID:
1
File name:
999d567fa7c54493dff984905511d54b94c7d0d6c8034994108ef387cd433946
Verdict:
Malicious activity
Analysis date:
2025-07-31 11:38:00 UTC
Tags:
netreactor rat remcos auto-sch-xml
Link:
https://app.any.run/tasks/a8e73aa1-e93f-440e-a96a-ae519f2a427d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/18008/
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=688b53960b4775fb2133ee29
Tags:
virus spawn msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
filecoder formbook obfuscated packed packed packer_detected vbnet
Link:
https://www.filescan.io/uploads/688b539913488cfd44e27144/reports/a641433a-c6d3-49a3-b153-a810d09a0c2f/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/999d567fa7c54493dff984905511d54b94c7d0d6c8034994108ef387cd433946
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/16727544-fe7e-4dc0-a9df-2dfe7be1f647
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/999d567fa7c54493dff984905511d54b94c7d0d6c8034994108ef387cd433946
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable PDB Path PE (Portable Executable) SOS: 0.29 Win 32 Exe x86
Link:
https://app.malva.re/file/9ff6d2bec74148c875392bc578ffd2af
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/999d567fa7c54493dff984905511d54b94c7d0d6c8034994108ef387cd433946/
Verdict:
Malicious
Threat:
Family.REMCOS
Link:
https://tip.neiki.dev/file/999d567fa7c54493dff984905511d54b94c7d0d6c8034994108ef387cd433946
Threat name:
ByteCode-MSIL.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2025-07-11 14:16:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
33
AV detection:
26 of 37 (70.27%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tgovm75hyvcjhx7zqsifkeovjokmpugwzabutfaqr3zyptkdhfda._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
remcos
Create hunting rule
Similar samples:
1b8e6aed1e468008650e35a6442152c2a9a2aa6b75d4e93857e85642b0451368
RemcosRAT
30a2111fc32aa43eb5e19bbe6a17b4653387dc46c7b4c90f2b735fd1e58a05a9
RemcosRAT
9b8d1a1040432b1ea93efb6b445261d55f5b1b22fc868e238a455a887dc5da48
RemcosRAT
ac56ec5a81bca833585ad1c052dc5614936523763c87ade64f519b23a4f0b24a
RemcosRAT
d56df9be7fc5ff907c8e58dc441a31bc7d75c354d83e96ba814e69138929583b
RemcosRAT
error
RemcosRAT
+ 4'109 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:july 710 akpty discovery execution persistence rat
Link:
https://tria.ge/reports/250731-nlqcjahj8s/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Remcos
Remcos family
Malware Config
C2 Extraction:
mxsunami.gotdns.ch:9373
193.56.135.117:9373
198.54.129.52:6623
mxsunama.gotdns.ch:6623
mxsunamo.gotdns.ch:9373
mxsuname.gotdns.ch:5804
leehoi01.duckdns.org:9373
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/fd591406-4d50-44c1-bdae-5f5c352f0f89
Unpacked files
SH256 hash:
999d567fa7c54493dff984905511d54b94c7d0d6c8034994108ef387cd433946
MD5 hash:
9ff6d2bec74148c875392bc578ffd2af
SHA1 hash:
347455cc3aae93e4a5322785675bb3d535994199
Link:
https://www.unpac.me/results/2c6e756b-9a46-4440-8a6c-bdac060cb2b1/
SH256 hash:
8786a16eb7b6a78a29c5c335f843c58d6438d1eadd69a133155dda24964d09bb
MD5 hash:
3abdc6c87e05f21d4b97059bd0f77a2d
SHA1 hash:
2777a63f9b8dfe87722b8a7d0795eeee48d73886
Detections:
win_remcos_w0
Create hunting rule
win_remcos_auto
Create hunting rule
Remcos
Create hunting rule
malware_windows_remcos_rat
Create hunting rule
win_remcos_rat_unpacked
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Link:
https://www.unpac.me/results/2c6e756b-9a46-4440-8a6c-bdac060cb2b1/
SH256 hash:
9fef1a672aaec69721b459f3ff2e772a47d537ca6e9316b95d3895065dacb7bc
MD5 hash:
50cf0fdd21ac3f5d9fe0b39f7414e204
SHA1 hash:
68d6acb7cf15c5a17e514e0170a1ac0f9ebde67e
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/2c6e756b-9a46-4440-8a6c-bdac060cb2b1/
Parent samples :
49327b6fefdbd1c747e705e3f5c8cba7161aa3a55c626548fb39337b0d347571
9b8128d013706f374ddaab6573aaad7fb1767cc4459716597836d838acf2c80c
c9a5fff84aef8b46605c9414b3d20e1f190e902454757c1f89179c5436422109
bcd2512db9d2789cd0ad058f0c2fd676cf37368174a75a95306f229df5d66dd2
4ae6b4139407e03c9d0d67b1992ebd2db0000b4e261e0f18925a8fd72d99ffc5
ef0bd2efdf9c627ba46eda7787db6cce870fc6eded31354d07a1075c81e23483
85f0df12788fb83928af7c24022447312c0fb590c4bad7a205d533e96ac67f22
5ef6ec513cbff82ef5e357753db46627351be6fe83d83fe05485d06330735849
999d567fa7c54493dff984905511d54b94c7d0d6c8034994108ef387cd433946
SH256 hash:
a5ee35340e3439c7d7d83d229a987dacb9ff1e507fa4c2e3c9728a367bad0516
MD5 hash:
9a8f531c9223484d741bff4135f2f081
SHA1 hash:
7396809b7e90b8fbf9c60e9aa693de0fc83d3b53
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/2c6e756b-9a46-4440-8a6c-bdac060cb2b1/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/999d567fa7c5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/999d567fa7c54493dff984905511d54b94c7d0d6c8034994108ef387cd433946

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla_DIFF_Common_Strings_01
Create hunting rule
Author:schmidtsz
Description:Identify partial Agent Tesla strings
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/18008/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments