MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 99baff0a339c9ef6cecae9c1ea5d6af3a9305840ab163ef410ee89d0d5dc9ae5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 99baff0a339c9ef6cecae9c1ea5d6af3a9305840ab163ef410ee89d0d5dc9ae5
SHA3-384 hash: 90a95ceb70ef27be29db28464c060ba44c43117dd9eb35a691b46669fca6d8eeb399b26463412766da8702d20f1919d8
SHA1 hash: 55320e175e473bb6469f1910da336c1fb539b100
MD5 hash: 0b62a3c403ca14b9a749fd4c6570f235
humanhash: bakerloo-alanine-winner-speaker
File name:RFQ-308600900001.pdf.js
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:549'522 bytes
First seen:2026-08-11 14:30:58 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 6144:AUz56ATbEvDr9NS0iP7PQB5mnAIFyCdFnn1kf4fOk8TgToxER3Ru:AGR2r9EPjQWAIPjIg/mg8xERA
TLSH T1D1C41F1D457AE00A20216C60DB85A4E1637E9DCF5F5F019B164E88FDBB8726802A7FFD
TrID 66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1)
33.3% (.MP3) MP3 audio (1000/1)
Magika txt
Reporter abuse_ch
Tags:js RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
128
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
downloader evasive forfiles lolbin masquerade repaired
Link:
https://www.filescan.io/uploads/6a7b32654d0e928aec88f123/reports/ed966160-6e99-4e82-ba7f-ea0012e646b4/overview
Verdict:
Suspicious
Labled as:
JS/Agent.EVW
Link:
https://www.hybrid-analysis.com/sample/99baff0a339c9ef6cecae9c1ea5d6af3a9305840ab163ef410ee89d0d5dc9ae5
Verdict:
Malicious
File Type:
js
First seen:
2026-08-11T09:18:00Z UTC
Last seen:
2026-08-12T13:10:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/99baff0a339c9ef6cecae9c1ea5d6af3a9305840ab163ef410ee89d0d5dc9ae5/results?tab=lookup
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1956075
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to register a low level keyboard hook
Contains functionality to steal Internet Explorer form passwords
Contains functionalty to change the wallpaper
Creates an undocumented autostart registry key
Detected Remcos RAT
Found malware configuration
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
JScript performs obfuscated calls to suspicious functions
Malicious sample detected (through community Yara rule)
Sigma detected: Remcos
Sigma detected: Suspicious Parent Double Extension File Execution
Sigma detected: WScript or CScript Dropper
Sigma detected: WScript or CScript Dropper - File
Suspicious execution chain found
Tries to harvest and steal browser information (history, passwords, etc)
Unusual module load detection (module proxying)
Uses an obfuscated file name to hide its real file extension (double extension)
Uses dynamic DNS services
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
WScript reads language and country specific registry keys (likely country aware script)
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1956075 Sample: RFQ-308600900001.pdf.js Startdate: 11/08/2026 Architecture: WINDOWS Score: 100 39 newpapidnsorg.duckdns.org 2->39 41 seniorsushi.com 2->41 47 Found malware configuration 2->47 49 Malicious sample detected (through community Yara rule) 2->49 51 Antivirus detection for URL or domain 2->51 55 9 other signatures 2->55 10 wscript.exe 2 4 2->10         started        signatures3 53 Uses dynamic DNS services 39->53 process4 file5 31 C:\Users\user\AppData\Local\...\v9001.js, Unicode 10->31 dropped 61 JScript performs obfuscated calls to suspicious functions 10->61 63 Creates an undocumented autostart registry key 10->63 65 Windows Scripting host queries suspicious COM object (likely to drop second stage) 10->65 67 2 other signatures 10->67 14 forfiles.exe 1 10->14         started        signatures6 process7 process8 16 cmd.exe 1 14->16         started        18 conhost.exe 14->18         started        process9 20 powershell.exe 14 7 16->20         started        24 cmd.exe 1 16->24         started        dnsIp10 43 seniorsushi.com 103.153.182.81, 443, 49706 SNTHOSTINGS-AS-APSnTHostingsIN United States 20->43 57 Writes to foreign memory regions 20->57 59 Injects a PE file into a foreign processes 20->59 26 CasPol.exe 4 3 20->26         started        signatures11 process12 dnsIp13 45 newpapidnsorg.duckdns.org 103.67.163.101, 2404, 49707, 49708 EZTECH-VNEZTECHNOLOGYCOMPANYLIMITEDVN Vietnam 26->45 33 C:\Users\user\AppData\...\Login Data.tmp, SQLite 26->33 dropped 35 C:\Users\user\AppData\...\Login Data.tmp, SQLite 26->35 dropped 37 C:\Users\user\...\Login Data For Account.tmp, SQLite 26->37 dropped 69 Contains functionality to bypass UAC (CMSTPLUA) 26->69 71 Detected Remcos RAT 26->71 73 Contains functionalty to change the wallpaper 26->73 75 4 other signatures 26->75 file14 signatures15
Score:
81%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/99baff0a339c9ef6cecae9c1ea5d6af3a9305840ab163ef410ee89d0d5dc9ae5
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/99baff0a339c9ef6cecae9c1ea5d6af3a9305840ab163ef410ee89d0d5dc9ae5/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tg5p6crttsppntwk5ha6uxlk6outawcavmld55aq52e5bvo4tlsq._file
Verdict:
malicious
Label(s):
Remcos
Create hunting rule
Link:
https://reports.threatray.com/dfc9a1ff-5fe9-4bfa-97d7-d983bb69eacc
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:client collection defense_evasion discovery execution persistence rat
Link:
https://tria.ge/reports/260811-rv76gseg94/
Behaviour
Runs regedit.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
Executes a command shell one-liner
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Indirect Command Execution
Registers new Windows logon scripts automatically executed at logon.
Badlisted process makes network request
Downloads MZ/PE file
Family: Remcos
Malware Config
C2 Extraction:
newpapidnsorg.duckdns.org:2404
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.25
Link:
https://yomi.yoroi.company/submissions/99baff0a339c9ef6cecae9c1ea5d6af3a9305840ab163ef410ee89d0d5dc9ae5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments