MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9d1e3508dd2a6c156c752f2697b6c005639edb2c3bda871db5a330f7465ae129. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 14


Intelligence 14 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9d1e3508dd2a6c156c752f2697b6c005639edb2c3bda871db5a330f7465ae129
SHA3-384 hash: d95a863585d748bdfd1cc6ad57a35fea2df497acd984fcb537025158034861e0de5b6e2d2beab4cb6109986753876308
SHA1 hash: 3c66c86bab793d4e26b75e5a7f6c97f6d1d52b4c
MD5 hash: be40090d94d51ca6e3ca039e1ad5984b
humanhash: december-white-kilo-angel
File name:United Alliance-QDB80300028.chm
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:76'945 bytes
First seen:2025-11-02 19:29:54 UTC
Last seen:Never
File type:
MIME type:application/vnd.ms-htmlhelp
ssdeep 1536:ZutYvdh38n/DDIrX+OPcVnnM1CUJsxJY3NFgH84NA+2syuQee:UtYvf8nIixM1CHUzg8QA+2ge
Threatray 4'098 similar samples on MalwareBazaar
TLSH T1CD7302E6A10B2650C2AF97B56EECD16488950E60824F1410D30D935C3FBFB936BB7385
TrID 81.0% (.CHI) Windows HELP Index (17144/6)
18.9% (.CHM) Windows HELP File (4000/1)
Magika chm
Reporter smica83
Tags:chm RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
HU HU
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.24762.ChmHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Badmacro.24762.ChmHeur.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.PkillCHMSlick.20220815.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6907b16f9942f1282ecb7e67
Tags:
delphi emotet
Result
Verdict:
Malicious
File Type:
CHM File - Malicious
Link:
https://app.docguard.net/9d1e3508dd2a6c156c752f2697b6c005639edb2c3bda871db5a330f7465ae129/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug fingerprint installer-heuristic keylogger packed
Link:
https://www.filescan.io/uploads/6907b16ddbc85c86b689c7a5/reports/75df42f9-cd89-45cb-9bc1-10f5d37a282d/overview
Verdict:
Malicious
Labled as:
Exploit.CHM
Link:
https://www.hybrid-analysis.com/sample/9d1e3508dd2a6c156c752f2697b6c005639edb2c3bda871db5a330f7465ae129
Verdict:
Malicious
File Type:
chm
First seen:
2025-11-01T03:07:00Z UTC
Last seen:
2025-11-04T16:38:00Z UTC
Hits:
~1000
Detections:
Trojan-Dropper.Win32.Agent.sb PDM:Exploit.Win32.Generic Exploit.Win32.BypassUAC.sb Backdoor.Win32.Remcos.sb Backdoor.Win32.Remcos.e HEUR:Trojan-Downloader.HTML.ChmGhost.gen HEUR:Trojan.Script.Generic Trojan.Win32.Inject.sb HEUR:Backdoor.Win32.Remcos.gen Backdoor.Win32.Remcos.f Backdoor.Win32.Agent.sb Trojan.Multi.Agent.sb Trojan.JS.SAgent.sb Trojan-Spy.Win32.Xegumumune.sbc
Link:
https://opentip.kaspersky.com/9d1e3508dd2a6c156c752f2697b6c005639edb2c3bda871db5a330f7465ae129/results?tab=lookup
Score:
35%
Verdict:
Susipicious
File Type:
ARCHIVE
Link:
https://malprob.io/report/9d1e3508dd2a6c156c752f2697b6c005639edb2c3bda871db5a330f7465ae129
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9d1e3508dd2a6c156c752f2697b6c005639edb2c3bda871db5a330f7465ae129/
Verdict:
Malicious
Threat:
Family.REMCOS
Link:
https://tip.neiki.dev/file/9d1e3508dd2a6c156c752f2697b6c005639edb2c3bda871db5a330f7465ae129
Threat name:
Document-HTML.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2025-11-02 03:03:08 UTC
File Type:
Binary (Archive)
Extracted files:
10
AV detection:
10 of 23 (43.48%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tupdkcg5fjwbk3dvf4tjpnwaavrz5wzmhpniohnvumypors24euq._file
Verdict:
malicious
Label(s):
dbatloader
Create hunting rule
remcos
Create hunting rule
Similar samples:
2c67cb07efe2293432a644febc18893d914f98bf533243769526ed22b0c464ab
RemcosRAT
30c7705fa01e39d97684b46547a73d3e4cc93f1d0909f9cfb0161a538032cecc
RemcosRAT
32aa0546c952a980435c113eeb04b6f9a82bf2b260e0b7b261010eaa585d55f1
RemcosRAT
9d1e3508dd2a6c156c752f2697b6c005639edb2c3bda871db5a330f7465ae129
RemcosRAT
aa56930042a94ecc6a42c1c4bbeadaf03229d2ec81784476c790977be5fc0100
RemcosRAT
dabd1fe619d046219b71202aa9b08107428b27beef8cce69137590dbb2fdce8a
RemcosRAT
dadb4ca52e1d3cb550a109590d9724b30c289f48017ee9d82d33ad5ae2411a92
RemcosRAT
error
RemcosRAT
+ 4'088 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:modiloader family:remcos botnet:remotehost defense_evasion discovery execution persistence rat trojan
Link:
https://tria.ge/reports/251102-x794hacl4x/
Behaviour
Kills process with taskkill
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Hide Artifacts: Hidden Window
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Downloads MZ/PE file
ModiLoader Second Stage
ModiLoader, DBatLoader
Modiloader family
Remcos
Remcos family
Malware Config
C2 Extraction:
212.162.149.200:443
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9d1e3508dd2a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9d1e3508dd2a6c156c752f2697b6c005639edb2c3bda871db5a330f7465ae129

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CHM_File_Executes_JS_Via_PowerShell
Create hunting rule
Author:daniyyell
Description:Detects a Microsoft Compiled HTML Help (CHM) file that executes embedded JavaScript to launch a messagebox via PowerShell

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments