MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b7d13fa425c5087f1bf1aa84edd0c5d870b3eb553920e2f404809b632e92530b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b7d13fa425c5087f1bf1aa84edd0c5d870b3eb553920e2f404809b632e92530b
SHA3-384 hash:	5f04a42e497fab54da63eef4194d999802b49e91c3b63951715d5b16f21c5d809aebe9a39ad68b5f60565c2601db774b
SHA1 hash:	fbcab8a49494c52b377863291204e7b351cec41a
MD5 hash:	ae57d785794bb2f50d651c2101203040
humanhash:	jig-two-king-neptune
File name:	Quotation-11343224532 RFQ LF12234263 22-06-2026.rar
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	2'205'808 bytes
First seen:	2026-06-22 09:20:36 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	49152:e0WN2/q+cXD2OKeiol0hCwcNxVsG+vUcgQLgpxjzYNabPabfz:2Nj+6yO224UKYxg0Mz
TLSH	T19CA5333268824F592759137AFE9F439BC60D7AB913B5A6D62398D0305FF5C79BC02328
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	proxylife
Tags:	rar RemcosRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

83

Origin country :

DK

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Quotation-11343224532 RFQ LF12234263 22-06-2026.js
File size:	3'271'520 bytes
SHA256 hash:	2931a9c2c43d5f3b99cdb5cc8e98e7a609479b5040c13a21bc3281acc2bfc468
MD5 hash:	3ab53dc3c721d114e014c430fe988d27
MIME type:	text/plain
Signature	RemcosRAT

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/decca82d-8006-41e4-8324-8042ea426b53/

ClamAV Detected

Detection(s):

Sanesecurity.Malware.32567.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Suspicious-Rar-JS.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a38fe8286bc95245bf8a098

Tags:

loveletter vmdetect

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm anti-vm aspnet_compiler base64 base64 encrypted evasive evasive fingerprint lolbin obfuscated powershell reconnaissance repaired

Link:

https://www.filescan.io/uploads/6a38fe7290632a45f731cb9b/reports/4b0045d0-8e05-4b56-99e2-c27f44f6b65c/overview

Hybrid Analysis Trojan.Generic

Verdict:

Suspicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/b7d13fa425c5087f1bf1aa84edd0c5d870b3eb553920e2f404809b632e92530b

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2026-06-22T08:14:00Z UTC

Last seen:

2026-06-22T08:19:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/b7d13fa425c5087f1bf1aa84edd0c5d870b3eb553920e2f404809b632e92530b/results?tab=lookup

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

Rar Archive

Link:

https://app.malva.re/file/ae57d785794bb2f50d651c2101203040

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b7d13fa425c5087f1bf1aa84edd0c5d870b3eb553920e2f404809b632e92530b/

ReversingLabs TitaniumCloud Script-JS.Trojan.Heuristic

Threat name:

Script-JS.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-22 09:21:01 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

13 of 24 (54.17%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=w7it7jbfyueh6g7rvkco3ugf3bylh22vheqof5aeqcnwgluskmfq._file

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos botnet:remotehost defense_evasion discovery execution rat

Link:

https://tria.ge/reports/260622-lh2kaaax3m/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Kills process with taskkill

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Command and Scripting Interpreter: PowerShell

Family: Remcos

Malware Config

C2 Extraction:

ruffyayeaye.ddns.net:2404

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b7d13fa425c5087f1bf1aa84edd0c5d870b3eb553920e2f404809b632e92530b