MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a287e0ef9c97ea4ec7bb033c2c52076bd370270ae51288924b751ecbf7dd29ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a287e0ef9c97ea4ec7bb033c2c52076bd370270ae51288924b751ecbf7dd29ba
SHA3-384 hash:	b4c3238c648bdfee1e6e786c6218ad0074d4d91808b7f1ce68680f69491d4880b7e957d8b68c1f605861fd9dbd2cc3b3
SHA1 hash:	aab4af6fd626f537980b50a063d8e669ddc644c0
MD5 hash:	78cf155370dc240fdb3329d86bdd6dd6
humanhash:	maryland-fruit-india-gee
File name:	BOQ.js
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	2'601'814 bytes
First seen:	2026-06-22 15:16:40 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	3072:8tcDDiKHvqNCoHN13A4W5pSQ+njTSd8kzQwCk6jhdxEJp50Xy9uK1ig/r:3T
TLSH	T118C5121765E72D888DA07F886D64C1C4CFA84B0F9BCB9307767EE181AAB5C05CA5DF24
Magika	javascript
Reporter	abuse_ch
Tags:	js RemcosRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

106

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Sanesecurity.Malware.32532.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a3952ee86bc95245bf8b2f1

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

aes anti-vm base64 crypto evasive fingerprint obfuscated overlay powershell repaired zero-day

Link:

https://www.filescan.io/uploads/6a39530590632a45f7334099/reports/fc8eb7c7-32e7-43e8-b24e-d10a3a1ca978/overview

Hybrid Analysis Trojan/JS.Obfuscator

Verdict:

Suspicious

Labled as:

Trojan/JS.Obfuscator

Link:

https://www.hybrid-analysis.com/sample/a287e0ef9c97ea4ec7bb033c2c52076bd370270ae51288924b751ecbf7dd29ba

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-06-22T07:55:00Z UTC

Last seen:

2026-06-22T09:31:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/a287e0ef9c97ea4ec7bb033c2c52076bd370270ae51288924b751ecbf7dd29ba/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1931992

Signature

Antivirus detection for URL or domain

Creates processes via WMI

Found suspicious powershell code related to unpacking or dynamic code loading

JavaScript source code contains functionality to generate code involving a shell, file or stream

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Sigma detected: WScript or CScript Dropper

Sigma detected: WScript or CScript Dropper - File

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Yara detected Powershell decode and execute

Yara detected Powershell download and execute

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

7%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/a287e0ef9c97ea4ec7bb033c2c52076bd370270ae51288924b751ecbf7dd29ba

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a287e0ef9c97ea4ec7bb033c2c52076bd370270ae51288924b751ecbf7dd29ba/

Neiki Family.REMCOS

Verdict:

Malicious

Threat:

Family.REMCOS

Link:

https://tip.neiki.dev/file/a287e0ef9c97ea4ec7bb033c2c52076bd370270ae51288924b751ecbf7dd29ba

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ukd6b344s7ve5r53am6cyuqhnpjxajyk4ujiresloupmx565fg5a._file

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos botnet:japan action collection discovery execution persistence rat

Link:

https://tria.ge/reports/260622-sqhkpsdy3k/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

outlook_office_path

Command and Scripting Interpreter: JavaScript

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Command and Scripting Interpreter: PowerShell

Badlisted process makes network request

Family: Remcos

Process spawned unexpected child process

Malware Config

C2 Extraction:

japanaction059.duckdns.org:62699
japanaction059bk.duckdns.org:55931

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/a287e0ef9c97ea4ec7bb033c2c52076bd370270ae51288924b751ecbf7dd29ba