MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f7e88ddd7a74ba3fb2cd5c858d5a864e8dc640df11724daba3d31132de5eb4f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	9f7e88ddd7a74ba3fb2cd5c858d5a864e8dc640df11724daba3d31132de5eb4f
SHA3-384 hash:	1e03d17f1b07cd7f7a93da7815d2be4186a1ab105d9feea92be04302c0ef2363fff9568f7d3ddd817fce65b0a4c6393d
SHA1 hash:	1bc87376155c4f604939c37f42172ed921b11d39
MD5 hash:	0e3db6b52d558e48e2b3dc164a95de40
humanhash:	connecticut-minnesota-finch-sixteen
File name:	z1Dispatchnoteof21_10_2025-PB4902CBPB1701EP.bat
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	5'527 bytes
First seen:	2025-10-28 07:00:09 UTC
Last seen:	Never
File type:	bat
MIME type:	text/plain
ssdeep	96:WbsnxS7AOZMWCVGo5eVVrw27F5G68uzPdBaUObeOYWU6I1V:CYoAILC15Sy27FrzPb3OYWU6gV
TLSH	T1FCB1F7B29C103AB92C804CD6D4CB4D8F704B4D5F4A2966B4CC1F5AFEB9F9679521C076
Magika	txt
Reporter	FXOLabs
Tags:	bat RemcosRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

76

Origin country :

BR

Vendor Threat Intelligence

ANY.RUN remcos

Malware family:

remcos

Alert

Create hunting rule

ID:

1

File name:

z1Dispatchnoteof21_10_2025-PB4902CBPB1701EP.bat

Verdict:

Malicious activity

Analysis date:

2025-10-28 07:14:55 UTC

Tags:

auto-reg remcos rat

Link:

https://app.any.run/tasks/0cf2ecdc-f9df-4cba-9a4b-e15d5809f724

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/34390/

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69006a5b5de5ca2707532786

Tags:

xtreme shell sage

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

DNS request

Connection attempt

Sending a custom TCP request

Sending an HTTP GET request

Creating a file in the %AppData% directory

Using the Windows Management Instrumentation requests

Creating a process with a hidden window

Using obfuscated Powershell scripts

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

base64 obfuscated powershell

Link:

https://www.filescan.io/uploads/69006aea3a79800405fa2cce/reports/4f02c6d1-1697-472c-a3bd-c08d63d9d8fb/overview

Hybrid Analysis BAT/Agent.BDZ1

Verdict:

Suspicious

Labled as:

BAT/Agent.BDZ1

Link:

https://www.hybrid-analysis.com/sample/9f7e88ddd7a74ba3fb2cd5c858d5a864e8dc640df11724daba3d31132de5eb4f

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

ps1

First seen:

2025-10-28T00:39:00Z UTC

Last seen:

2025-10-30T04:36:00Z UTC

Hits:

~100

Detections:

HEUR:Trojan.BAT.Obfuscated.gen

Link:

https://opentip.kaspersky.com/9f7e88ddd7a74ba3fb2cd5c858d5a864e8dc640df11724daba3d31132de5eb4f/results?tab=lookup

Nucleon Malprob Malware

Score:

86%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/9f7e88ddd7a74ba3fb2cd5c858d5a864e8dc640df11724daba3d31132de5eb4f

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9f7e88ddd7a74ba3fb2cd5c858d5a864e8dc640df11724daba3d31132de5eb4f/

Neiki Family.REMCOS

Verdict:

Malicious

Threat:

Family.REMCOS

Link:

https://tip.neiki.dev/file/9f7e88ddd7a74ba3fb2cd5c858d5a864e8dc640df11724daba3d31132de5eb4f

ReversingLabs TitaniumCloud Script-PowerShell.Trojan.Heuristic

Threat name:

Script-PowerShell.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-10-28 06:19:39 UTC

File Type:

Text

AV detection:

8 of 38 (21.05%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=t57irxoxu5f2h6zm2xefrvnimtunyzan6elsjwv2huyrglpf5nhq._file

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos collection discovery execution persistence rat

Link:

https://tria.ge/reports/251028-hvj9zssqam/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses Microsoft Outlook accounts

Adds Run key to start application

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Detected Nirsoft tools

NirSoft MailPassView

NirSoft WebBrowserPassView

Remcos

Remcos family

Malware Config

C2 Extraction:

fteamez7iurs02.duckdns.org:12760

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9f7e88ddd7a74ba3fb2cd5c858d5a864e8dc640df11724daba3d31132de5eb4f

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

bat 9f7e88ddd7a74ba3fb2cd5c858d5a864e8dc640df11724daba3d31132de5eb4f

(this sample)

  

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/34390/