MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b6d4bfdebc63cb786be6937ebd3b6b902c55249a9079b6772733a58e2e16aa56. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b6d4bfdebc63cb786be6937ebd3b6b902c55249a9079b6772733a58e2e16aa56
SHA3-384 hash: 0364ceedf31c4d084e17a80beaf4efbb82283f6ccbfab407b13751e13ffa86dd2a2cee05adf1ca3ce2b33910b758f881
SHA1 hash: 9aec9db599611d47fd7e6c1cfb9db17f9b40dfe6
MD5 hash: 06e106b7840704838fa2e03d0e98f003
humanhash: kansas-butter-violet-xray
File name:shipment Docs_PO#RFQ109302.hta
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:33'359 bytes
First seen:2026-06-22 15:23:16 UTC
Last seen:Never
File type:HTML Application (hta) hta
MIME type:text/html
ssdeep 192:FpL5oCNJTBvebntAkJZHLmGiy4g9hIm5O1pOw5DL:Fr5P
Threatray 221 similar samples on MalwareBazaar
TLSH T1EEE2EC06A46E30044C7A6DEFD535081BA6D9EC7F702968537858B335A6BF23B10BDDAC
Magika html
Reporter abuse_ch
Tags:hta RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Script.SNH-gen.57623387.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
89.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a39545486bc95245bf8b48f
Tags:
n/a
Result
Verdict:
Clean
File Type:
HTA File
Link:
https://app.docguard.net/b6d4bfdebc63cb786be6937ebd3b6b902c55249a9079b6772733a58e2e16aa56/results/dashboard
Payload URLs
URL
File name
winmgmts:\\\\.\\roᬌқ
HTA File
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm base64 fingerprint obfuscated powershell
Link:
https://www.filescan.io/uploads/6a3953d990632a45f733427f/reports/0d6a484f-a000-4e0d-a821-9e849cb5aec7/overview
Verdict:
Suspicious
Labled as:
JS/LausivLoader.B trojan
Link:
https://www.hybrid-analysis.com/sample/b6d4bfdebc63cb786be6937ebd3b6b902c55249a9079b6772733a58e2e16aa56
Verdict:
Malicious
File Type:
hta
First seen:
2026-06-22T07:19:00Z UTC
Last seen:
2026-06-24T10:25:00Z UTC
Hits:
~1000
Detections:
Trojan.JS.SAgent.sb HEUR:Trojan.Script.Generic
Link:
https://opentip.kaspersky.com/b6d4bfdebc63cb786be6937ebd3b6b902c55249a9079b6772733a58e2e16aa56/results?tab=lookup
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1931948
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to register a low level keyboard hook
Contains functionalty to change the wallpaper
Creates autostart registry keys with suspicious names
Creates processes via WMI
Detected Remcos RAT
Found malware configuration
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Suspicious Process Parents
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Unusual module load detection (module proxying)
Writes to foreign memory regions
Yara detected Powershell decode and execute
Yara detected Powershell download and execute
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1931948 Sample: shipment Docs_PO#RFQ109302.hta Startdate: 22/06/2026 Architecture: WINDOWS Score: 100 35 massadev.com 2->35 37 icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev 2->37 45 Suricata IDS alerts for network traffic 2->45 47 Found malware configuration 2->47 49 Malicious sample detected (through community Yara rule) 2->49 51 12 other signatures 2->51 9 mshta.exe 2->9         started        12 svchost.exe 1 1 2->12         started        15 Calculator.exe 2 2->15         started        17 3 other processes 2->17 signatures3 process4 dnsIp5 71 Suspicious powershell command line found 9->71 73 Creates processes via WMI 9->73 19 powershell.exe 14 15 9->19         started        43 127.0.0.1 unknown unknown 12->43 signatures6 process7 dnsIp8 39 massadev.com 66.23.237.146, 443, 49684 IS-AS-1-InterserverIncUS United States 19->39 41 icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev 104.21.73.231, 443, 49683 CLOUDFLARENET-CloudflareIncUS Canada 19->41 53 Writes to foreign memory regions 19->53 55 Injects a PE file into a foreign processes 19->55 57 Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent) 19->57 23 calc.exe 19->23         started        26 calc.exe 2 3 19->26         started        29 conhost.exe 19->29         started        signatures9 process10 file11 59 Contains functionality to bypass UAC (CMSTPLUA) 23->59 61 Contains functionalty to change the wallpaper 23->61 63 Contains functionality to register a low level keyboard hook 23->63 65 Unusual module load detection (module proxying) 23->65 33 C:\Users\user\AppData\Roaming\...\light.exe, PE32 26->33 dropped 67 Detected Remcos RAT 26->67 69 Creates autostart registry keys with suspicious names 26->69 31 light.exe 12 26->31         started        signatures12 process13
Score:
65%
Verdict:
Susipicious
File Type:
SCRIPT
Link:
https://malprob.io/report/b6d4bfdebc63cb786be6937ebd3b6b902c55249a9079b6772733a58e2e16aa56
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b6d4bfdebc63cb786be6937ebd3b6b902c55249a9079b6772733a58e2e16aa56/
Verdict:
Malicious
Threat:
Family.REMCOSRAT
Link:
https://tip.neiki.dev/file/b6d4bfdebc63cb786be6937ebd3b6b902c55249a9079b6772733a58e2e16aa56
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2026-06-22 10:16:09 UTC
File Type:
Text (HTML)
Extracted files:
1
AV detection:
10 of 24 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=w3kl7xv4mpfxq27gsn7l2o3lsawfkje2sb43m5zhgosy4lqwvjla._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
08554a2e413370221dc5f5668d336886e2f66cdbcd14314b7a3b8e3d44febbb0
RemcosRAT
292568fdf69cebf5ed05e083517f210a0d4d9f94970990968714343a59f7317a
RemcosRAT
5076ae6b62c03eef7752e9bc8159fab299d9318b7c7dd1284d551332e9b12c38
RemcosRAT
99a218e5ef6b32d486a6fddfdea72a37a58f0681cf8ff4913a704b020831077b
RemcosRAT
ba08e2d253229e0f2c2766a7415b31f8b0f75f37b6c9277a0c794a10831b3275
RemcosRAT
c2574bcc8a31b914872643598086fd64f78d598ed34f5e225d1828ac9023ef4a
RemcosRAT
cc9dfcca94f44e8e1897099cebfcd4d7eb6dff56baacf1ed325520842a06e7f0
RemcosRAT
d4061c78f3dbc769af1f0a4964978c1ce7cf8f4701f3ab52e1b242b5b40d387f
RemcosRAT
d41c4e42ec7b047d855df45e8c5b6b8a14c94743e79e87589715ff776920cae7
RemcosRAT
d5b2b936f706efa296508c00b2a0549834813dc1a20400497d5c980cfbfef76b
RemcosRAT
error
RemcosRAT
+ 211 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery execution
Link:
https://tria.ge/reports/260622-stzcmady7p/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
System Location Discovery: System Language Discovery
Command and Scripting Interpreter: PowerShell
Badlisted process makes network request
Process spawned unexpected child process
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b6d4bfdebc63cb786be6937ebd3b6b902c55249a9079b6772733a58e2e16aa56

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MalScript_Tricks
Create hunting rule
Author:@bartblaze
Description:Identifies tricks often seen in malicious scripts such as moving the window off-screen or resizing it to zero.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments