MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9c6f80d730105771c2403d9ef774e4f0fd554a2cc048d6760477bfb833c4bb5c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 15

Intelligence 15 IOCs YARA 22 File information Comments

SHA256 hash:	9c6f80d730105771c2403d9ef774e4f0fd554a2cc048d6760477bfb833c4bb5c
SHA3-384 hash:	89b3e0673d331aa0e6fe1d74ae33ec313414abc26eb707e81931a8f857a6ce422e12fdb4198730d4cc1eb0099ea59b81
SHA1 hash:	1e072f8257180d00d8846d529ba5c8fdf1834caf
MD5 hash:	1f1667d0647514ed49578698d5992e36
humanhash:	ohio-queen-undress-indigo
File name:	9c6f80d730105771c2403d9ef774e4f0fd554a2cc048d6760477bfb833c4bb5c
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	887'296 bytes
First seen:	2026-02-05 15:07:24 UTC
Last seen:	2026-02-05 15:26:07 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	21371b611d91188d602926b15db6bd48 (79 x Formbook, 65 x AgentTesla, 34 x SnakeKeylogger)
ssdeep	24576:Sf+iN57Gtene3W7gipT45hIeHFciTyLzOXEu9JslR:8LXKtene3CgiReJFizON9W
Threatray	2'042 similar samples on MalwareBazaar
TLSH	T1B81523952592596AD1A5A330C423CC60C638BE304F47772E4B3CA92BAC383D7F977A5D
TrID	39.1% (.EXE) UPX compressed Win32 Executable (27066/9/6) 38.3% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4) 7.2% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.5% (.EXE) Win32 Executable (generic) (4504/4/1) 2.9% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
dhash icon	aae2f3e38383b629 (2'697 x Formbook, 1'203 x CredentialFlusher, 928 x AgentTesla)
Reporter	adrian__luca
Tags:	exe RemcosRAT UPX

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	887'296 bytes
File size (de-compressed) :	1'393'664 bytes
Format:	win32/pe
Unpacked file:	9f1ad57fea9aada4083b99e984e33f2cbdc7668b031f815ae94fc8f7b7919e4e

Intelligence

File Origin

# of uploads :

# of downloads :

114

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

AutoIt PEPacker

Details

AutoIt

extracted scripts and files

PEPacker

a UPX version number and an unpacked binary

Link:

https://research.acce.ciphertechsolutions.com/results/b51688e6-cbf9-4859-b0d6-ff918da4e1f0/

Malware family:

n/a

ID:

File name:

9c6f80d730105771c2403d9ef774e4f0fd554a2cc048d6760477bfb833c4bb5c.exe

Verdict:

No threats detected

Analysis date:

2026-01-14 20:30:22 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/08cb8945-8d53-4fc9-b42a-d1f87bfb236f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Remcos

Link:

https://www.capesandbox.com/analysis/51913/

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6967fcddef906a21abcd5376

Tags:

malware

Verdict:

Malicious

Labled as:

Cerbu.Generic

Link:

https://www.hybrid-analysis.com/sample/9c6f80d730105771c2403d9ef774e4f0fd554a2cc048d6760477bfb833c4bb5c

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-01-14T09:52:00Z UTC

Last seen:

2026-02-07T11:17:00Z UTC

Hits:

~10000

Link:

https://opentip.kaspersky.com/9c6f80d730105771c2403d9ef774e4f0fd554a2cc048d6760477bfb833c4bb5c/results?tab=lookup

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/203a3201-0821-4a1d-b3cb-7008d0d9ad1b

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/9c6f80d730105771c2403d9ef774e4f0fd554a2cc048d6760477bfb833c4bb5c

Verdict:

Malware

YARA:

5 match(es)

Tags:

AutoIt Decompiled Executable PE (Portable Executable) PE File Layout Suspect Win 32 Exe x86

Link:

https://app.malva.re/file/1f1667d0647514ed49578698d5992e36

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9c6f80d730105771c2403d9ef774e4f0fd554a2cc048d6760477bfb833c4bb5c/

Verdict:

Malicious

Threat:

Family.REMCOS

Link:

https://tip.neiki.dev/file/9c6f80d730105771c2403d9ef774e4f0fd554a2cc048d6760477bfb833c4bb5c

Threat name:

Win32.Backdoor.FormBook

Status:

Malicious

First seen:

2026-01-14 13:52:55 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

28 of 36 (77.78%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=trxybvzqcblxdqsahwppo5he6d6vksrmybenm5qeo673qm6exnoa._file

Verdict:

malicious

Label(s):

remcos

RemcosRAT

02f7b0a5e5d5f342ac04d36ed2e79629714ed3a2d7fad472e60745ff9956db4d

RemcosRAT

5a4c063b95f880539280eb2a8d64ea2ec0401cda7c69e0a1db5b11c9954bb0f4

RemcosRAT

fc74d7bf40e65a783a3669ee174421f104a88e02086009c5425b8e203c2c88c1

RemcosRAT

fdc90f30bc517219e0f8bb99042e3f2c38fcb2bf61cc7ddf333e05bdb8473cf7

RemcosRAT

+ 2'032 additional samples on MalwareBazaar

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos botnet:remotehost discovery rat upx

Link:

https://tria.ge/reports/260205-sh6bsshs2a/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

Remcos

Remcos family

Malware Config

C2 Extraction:

178.16.54.26:5545

Unpacked files

SH256 hash:

9f1ad57fea9aada4083b99e984e33f2cbdc7668b031f815ae94fc8f7b7919e4e

MD5 hash:

bed965ab1c0fca67cab238ae8b4dc4bd

SHA1 hash:

a3aa9e241a49c3df6ec4384bb561787477fc40f2

Detections:

AutoIT_Compiled

Link:

https://www.unpac.me/results/950185e4-cd1e-47e2-ae66-0d5762f053e8/

Parent samples :

9c6f80d730105771c2403d9ef774e4f0fd554a2cc048d6760477bfb833c4bb5c
9f1ad57fea9aada4083b99e984e33f2cbdc7668b031f815ae94fc8f7b7919e4e

SH256 hash:

d1cd2dc88fbc579e94795a66ff80761f9415fd7d8b7090232151a2f977af0ba8

MD5 hash:

8cf392c2abfe08d67e22380263239c6e

SHA1 hash:

e804b95b453316e99c2938c467266aff38325cd3

Detections:

win_remcos_auto

win_remcos_w0

Remcos

malware_windows_remcos_rat

win_remcos_rat_unpacked

INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Link:

https://www.unpac.me/results/950185e4-cd1e-47e2-ae66-0d5762f053e8/

Parent samples :

9c6f80d730105771c2403d9ef774e4f0fd554a2cc048d6760477bfb833c4bb5c
9f1ad57fea9aada4083b99e984e33f2cbdc7668b031f815ae94fc8f7b7919e4e

SH256 hash:

9c6f80d730105771c2403d9ef774e4f0fd554a2cc048d6760477bfb833c4bb5c

MD5 hash:

1f1667d0647514ed49578698d5992e36

SHA1 hash:

1e072f8257180d00d8846d529ba5c8fdf1834caf

Link:

https://www.unpac.me/results/950185e4-cd1e-47e2-ae66-0d5762f053e8/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.91

Link:

https://yomi.yoroi.company/submissions/9c6f80d730105771c2403d9ef774e4f0fd554a2cc048d6760477bfb833c4bb5c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM Create hunting rule
Author:	ditekSHen
Description:	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	Remcos Create hunting rule
Author:	kevoreilly
Description:	Remcos Payload

Rule name:	REMCOS_RAT_variants Create hunting rule

Rule name:	Remcos_unpacked_PulseIntel Create hunting rule
Author:	PulseIntel
Description:	Remcos Payload

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	upx_largefile Create hunting rule
Author:	k3nr9

Rule name:	Windows_Trojan_Remcos_b296e965 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.remcos.

Rule name:	win_remcos_rat_unpacked Create hunting rule
Author:	Matthew @ Embee_Research
Description:	Detects strings present in remcos rat Samples.

Rule name:	win_remcos_w0 Create hunting rule
Author:	Matthew @ Embee_Research
Description:	Detects strings present in remcos rat Samples.

Rule name:	yarahub_win_remcos_rat_unpacked_aug_2023 Create hunting rule
Author:	Matthew @ Embee_Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

RemcosRAT

exe 9c6f80d730105771c2403d9ef774e4f0fd554a2cc048d6760477bfb833c4bb5c

(this sample)

RemcosRAT

exe 9f1ad57fea9aada4083b99e984e33f2cbdc7668b031f815ae94fc8f7b7919e4e

Cape

https://www.capesandbox.com/analysis/51913/

Dropping

SHA256 9f1ad57fea9aada4083b99e984e33f2cbdc7668b031f815ae94fc8f7b7919e4e

Dropping

MD5 bed965ab1c0fca67cab238ae8b4dc4bd

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample