MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9ee0df282bc2c2c3a77d2c2d886b25ddcc0c91f71c3af832b2c86439d1fc6a3d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 22


Intelligence 22 IOCs YARA 17 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9ee0df282bc2c2c3a77d2c2d886b25ddcc0c91f71c3af832b2c86439d1fc6a3d
SHA3-384 hash: c885443c828a1f57040b95e19d2382fec58b9069aedd0cd2ae0a93424b5ca85fbd0bfaa47a3a5b26c50d7845c189d7f8
SHA1 hash: a3617d7706d07c7c80e90d4bea5b314aa803ff99
MD5 hash: fb61770fd19d3b1b919dfa88be6032f4
humanhash: idaho-saturn-florida-high
File name:w.exe.bin
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:486'400 bytes
First seen:2026-01-15 05:24:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 69f1ad4b864e2aa9e4d714b7029c7229 (1 x RemcosRAT)
ssdeep 12288:Rmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQAt5E:viLJbpI7I2WhQqZ9
Threatray 3'999 similar samples on MalwareBazaar
TLSH T1D8A4BF02BAC1C072D57161344D3AE725DEB8BD20283595BB73E62D5AEE701D0A73E7B2
TrID 32.2% (.EXE) Win64 Executable (generic) (10522/11/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4504/4/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
dhash icon e09a676060678ee0 (14 x AsyncRAT, 10 x ValleyRAT, 4 x Formbook)
Reporter abuse_ch
Tags:exe RemcosRAT upx-dec


Avatar
abuse_ch
UPX decompressed file, sourced from SHA256 46018fbcf205ace11c502a5cec83c19c69d3849c2bf99cb977e8ab8de905a5d4
File size (compressed) :254'976 bytes
File size (de-compressed) :486'400 bytes
Format:win32/pe
Packed file: 46018fbcf205ace11c502a5cec83c19c69d3849c2bf99cb977e8ab8de905a5d4

Intelligence

File Origin
# of uploads :
1
# of downloads :
172
Origin country :
NL NL
Vendor Threat Intelligence
Malware configuration found for:
Remcos
Details
Remcos
a version number and verbose configuration settings
Link:
https://research.acce.ciphertechsolutions.com/results/bc62d832-cba2-4d28-a716-827fb1055469/
Malware family:
remcos
Create hunting rule
ID:
1
File name:
w.exe.bin
Verdict:
Malicious activity
Analysis date:
2026-01-15 05:25:18 UTC
Tags:
rat remcos remote auto-reg
Link:
https://app.any.run/tasks/f76e7521-459c-4bb7-9377-69e7bf1b79d0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/48943/
Detection(s):
Win.Trojan.Remcos-9841897-0
Create hunting rule

Win.Trojan.Remcos-10002580-0
Create hunting rule

SecuriteInfo.com.BackDoor.Remcos.526.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69687a52ef906a21abcd64b4
Tags:
dropper remcos virus sage
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug cmd config-extracted crypto evasive eventvwr fingerprint keylogger lolbin masquerade microsoft_visual_cc packed packed rat rat remcos remcos rescoms unsafe windows
Link:
https://www.filescan.io/uploads/69687a4eb5214ecba5f0133c/reports/f9a82fb9-d69f-4259-8efc-87f79f7f741a/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/9ee0df282bc2c2c3a77d2c2d886b25ddcc0c91f71c3af832b2c86439d1fc6a3d
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-01-12T08:45:00Z UTC
Last seen:
2026-01-13T07:39:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan.Win32.Generic
Link:
https://opentip.kaspersky.com/9ee0df282bc2c2c3a77d2c2d886b25ddcc0c91f71c3af832b2c86439d1fc6a3d/results?tab=lookup
Malware family:
REMCOS
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b723451d-910c-4b48-95c6-3360b3921650
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1851052
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Delayed program exit found
Disables UAC (registry)
Found malware configuration
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Uses cmd line tools excessively to alter registry or file data
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1851052 Sample: w.exe.bin.exe Startdate: 15/01/2026 Architecture: WINDOWS Score: 100 54 wwwyandex.org 2->54 60 Suricata IDS alerts for network traffic 2->60 62 Found malware configuration 2->62 64 Malicious sample detected (through community Yara rule) 2->64 66 10 other signatures 2->66 11 w.exe.bin.exe 5 5 2->11         started        15 Telegram.exe 2->15         started        17 Telegram.exe 2->17         started        19 Telegram.exe 2->19         started        signatures3 process4 file5 46 C:\ProgramData\Telegram\Telegram.exe, PE32 11->46 dropped 48 C:\Users\user\AppData\Local\...\install.vbs, data 11->48 dropped 50 C:\...\Telegram.exe:Zone.Identifier, ASCII 11->50 dropped 74 Contains functionalty to change the wallpaper 11->74 76 Contains functionality to steal Chrome passwords or cookies 11->76 78 Contains functionality to register a low level keyboard hook 11->78 80 2 other signatures 11->80 21 wscript.exe 1 11->21         started        24 cmd.exe 1 11->24         started        signatures6 process7 signatures8 68 Windows Scripting host queries suspicious COM object (likely to drop second stage) 21->68 26 cmd.exe 1 21->26         started        70 Uses cmd line tools excessively to alter registry or file data 24->70 28 reg.exe 1 24->28         started        31 conhost.exe 24->31         started        process9 signatures10 33 Telegram.exe 2 1 26->33         started        37 conhost.exe 26->37         started        82 Disables UAC (registry) 28->82 process11 dnsIp12 52 wwwyandex.org 212.11.64.185, 49718, 5412 CALYPSO-ITDE United Kingdom 33->52 56 Antivirus detection for dropped file 33->56 58 Multi AV Scanner detection for dropped file 33->58 39 cmd.exe 33->39         started        signatures13 process14 signatures15 72 Uses cmd line tools excessively to alter registry or file data 39->72 42 conhost.exe 39->42         started        44 reg.exe 1 39->44         started        process16
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/9ee0df282bc2c2c3a77d2c2d886b25ddcc0c91f71c3af832b2c86439d1fc6a3d
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/fb61770fd19d3b1b919dfa88be6032f4
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/9ee0df282bc2c2c3a77d2c2d886b25ddcc0c91f71c3af832b2c86439d1fc6a3d/
Verdict:
Malicious
Threat:
Family.REMCOS
Link:
https://tip.neiki.dev/file/9ee0df282bc2c2c3a77d2c2d886b25ddcc0c91f71c3af832b2c86439d1fc6a3d
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2026-01-12 13:38:25 UTC
AV detection:
32 of 38 (84.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=t3qn6kblylbmhj35fqwyq2zf3xgazepxdq5pqmvszbsdtup4ni6q._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
41700fe0e7369606d4c4739998f3eab0b911c42261b36152424b3907b755e567
RemcosRAT
4f7e671c26e269961ffa6a6639a5522b66c06c8c119bdfb297797473bb7b4cbc
RemcosRAT
52207df335c820318cdaae9991f9a57af0601e9fe99eac755c7bd46b2cba5e25
RemcosRAT
7f418aa89e1a6200adcfe264ec8428f7e45e3c381ca37206cb147abdd0e80a68
RemcosRAT
aa9c2d27050b02a8fc47d79e519aeaec6a94190abfc366cf684bf31cf59fbc0d
RemcosRAT
c55a99f4892cff3491e27edc6230f8e9087291117965c769128ff5c46b0524bb
RemcosRAT
c8401fbd58fa8fff63277c5fb63ce13e95769a2e8e7aed9baec1d05e516274af
RemcosRAT
c9da21d05843d54922d10a1cb421be65c379e9c21d9b7e0dba5b4c6922ad6739
RemcosRAT
d27254c6dff8ec2d0262ec8a302d740770c02c2cb012d82cfb1c15dfb2572805
RemcosRAT
error
RemcosRAT
+ 3'989 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:telegram defense_evasion discovery persistence rat trojan
Link:
https://tria.ge/reports/260115-f4kk1acz3a/
Behaviour
Modifies registry class
Modifies registry key
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Remcos
Remcos family
UAC bypass
Malware Config
C2 Extraction:
wwwyandex.org:5412
Verdict:
Malicious
Tags:
rat remcos Win.Trojan.Remcos-9841897-0
YARA:
malware_windows_remcos_rat REMCOS_RAT_variants Remcos_Payload win_remcos_rat_unpacked Windows_Trojan_Remcos_b296e965 MAL_EXE_Remcos_RAT_Jul_22 Remcos
Link:
https://app.threat.zone/submission/85f7266d-0fc3-4821-a90a-788a8556bf3e
Unpacked files
SH256 hash:
9ee0df282bc2c2c3a77d2c2d886b25ddcc0c91f71c3af832b2c86439d1fc6a3d
MD5 hash:
fb61770fd19d3b1b919dfa88be6032f4
SHA1 hash:
a3617d7706d07c7c80e90d4bea5b314aa803ff99
Detections:
win_remcos_auto
Create hunting rule
win_remcos_w0
Create hunting rule
Remcos
Create hunting rule
malware_windows_remcos_rat
Create hunting rule
win_remcos_rat_unpacked
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Link:
https://www.unpac.me/results/dbaeddf2-1c58-4981-a146-bfb5ab562419/
Parent samples :
9ee0df282bc2c2c3a77d2c2d886b25ddcc0c91f71c3af832b2c86439d1fc6a3d
46018fbcf205ace11c502a5cec83c19c69d3849c2bf99cb977e8ab8de905a5d4
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9ee0df282bc2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9ee0df282bc2c2c3a77d2c2d886b25ddcc0c91f71c3af832b2c86439d1fc6a3d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:iexplorer_remcos
Create hunting rule
Author:iam-py-test
Description:Detect iexplorer being taken over by Remcos
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Windows_Trojan_Remcos_b296e965
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.remcos.
Rule name:win_remcos_rat_unpacked
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in remcos rat Samples.
Rule name:win_remcos_w0
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in remcos rat Samples.
Rule name:yarahub_win_remcos_rat_unpacked_aug_2023
Create hunting rule
Author:Matthew @ Embee_Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

RemcosRAT

Executable exe 46018fbcf205ace11c502a5cec83c19c69d3849c2bf99cb977e8ab8de905a5d4

RemcosRAT

Executable exe 9ee0df282bc2c2c3a77d2c2d886b25ddcc0c91f71c3af832b2c86439d1fc6a3d

(this sample)

  
Dropped by
SHA256 46018fbcf205ace11c502a5cec83c19c69d3849c2bf99cb977e8ab8de905a5d4
Cape
Cape
https://www.capesandbox.com/analysis/48943/
  
Dropped by
MD5 2879058452ff1a5c7607ae9d0d42aa2e

Comments