MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ad3c80ea9430278dae35e4c5fd8656e1dc577f6d53c6ea4242b72f6a1f42c5c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ad3c80ea9430278dae35e4c5fd8656e1dc577f6d53c6ea4242b72f6a1f42c5c8
SHA3-384 hash:	d9791c0ae63cf52a4f6dd748fb0cf81fd5be1291fb096f426a8467c0896bd96e402a3873f37623d0696a8c6a83fa3383
SHA1 hash:	14c9ba04571c55e09b0470fe5a05e4297b47d769
MD5 hash:	843db60981c75b4037a8292e6842eda0
humanhash:	william-lamp-one-timing
File name:	JAL64.js
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	4'334'430 bytes
First seen:	2026-11-02 08:50:12 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	98304:nRpKAlBV6t+940dAUCjoncwLhUxiu44Wj8uIUix3TPhKYYSruSLBWq5gnwwloIhm:3nTET5KY7ruSLBWdbfNWPq+hoRxfWyPM
TLSH	T12C1695BFCA320E11FCE82DD4E05257F44E3EDB96D4537AC639A2E94A51B9CE03C65620
Magika	css
Reporter	abuse_ch
Tags:	js RAT RemcosRAT

abuse_ch

RemcosRAT C2:
5.175.253.126:2404

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

217

Origin country :

NL

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.JS.Crypt.30830.24803.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ae84eca38ccdea12c568b2b

Tags:

trojan

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug crypto dropper evasive expand expired-cert lolbin lolbin obfuscated reconnaissance repaired wscript

Link:

https://www.filescan.io/uploads/6ae84f00997978972f5040e8/reports/e5a04a8b-0b72-49af-8923-ae3ce6ef044a/overview

Hybrid Analysis JS/TrojanDropper.ModiLoader

Verdict:

Suspicious

Labled as:

JS/TrojanDropper.ModiLoader

Link:

https://www.hybrid-analysis.com/sample/ad3c80ea9430278dae35e4c5fd8656e1dc577f6d53c6ea4242b72f6a1f42c5c8

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-11-02T05:45:00Z UTC

Last seen:

2026-11-03T12:14:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/ad3c80ea9430278dae35e4c5fd8656e1dc577f6d53c6ea4242b72f6a1f42c5c8/results?tab=lookup

Joe Sandbox Remcos

Result

Threat name:

Remcos

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1996541

Signature

C2 URLs / IPs found in malware configuration

Contains functionality to inject threads in other processes

Contains functionality to steal Internet Explorer form passwords

Creates an undocumented autostart registry key

Detected Remcos RAT

Found direct / indirect Syscall (likely to bypass EDR)

Found malware configuration

JavaScript file contains suspicious strings

JavaScript source code contains functionality to generate code involving a shell, file or stream

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Remcos

Sigma detected: WScript or CScript Dropper

Sigma detected: WScript or CScript Dropper - File

Suricata IDS alerts for network traffic

Tries to detect sandboxes / dynamic malware analysis system (Installed program check)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file registry)

Unusual module load detection (module proxying)

Uses dynamic DNS services

Windows Scripting host queries suspicious COM object (likely to drop second stage)

WScript reads language and country specific registry keys (likely country aware script)

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

98%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/ad3c80ea9430278dae35e4c5fd8656e1dc577f6d53c6ea4242b72f6a1f42c5c8

Malva.RE Malware

Verdict:

Malware

YARA:

1 match(es)

Tags:

DeObfuscated Javascript Obfuscated T1027 T1059.007

Link:

https://app.malva.re/file/843db60981c75b4037a8292e6842eda0

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ad3c80ea9430278dae35e4c5fd8656e1dc577f6d53c6ea4242b72f6a1f42c5c8/

ReversingLabs TitaniumCloud Win32.Downloader.ModiLdr

Threat name:

Win32.Downloader.ModiLdr

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-11-02 08:51:19 UTC

File Type:

Text (JavaScript)

AV detection:

8 of 38 (21.05%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vu6ib2uugaty3lrv4tc73bsw4hofo73nkpdouqscw4xwuh2cyxea._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

execution persistence

Link:

https://tria.ge/reports/261102-krp26s11fv/

Behaviour

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Registers new Windows logon scripts automatically executed at logon.

VirusSign modiloader

Malware Family:

modiloader

Alert

Create hunting rule

Malicious:

True

Tags:

javascript

Link:

https://intel.virussign.com/intelligence/file/ad3c80ea9430278dae35e4c5fd8656e1dc577f6d53c6ea4242b72f6a1f42c5c8

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.