MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8ca134d9a591243423531d4617faac7792011191aa05e3360a601aa34e0cfeb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b8ca134d9a591243423531d4617faac7792011191aa05e3360a601aa34e0cfeb
SHA3-384 hash:	440d13f7e5b0daf5fef801007f612fa0e81443b4680835d522636a861f0cfbe2a6ba47adcba5b04afecb2cc6922712b0
SHA1 hash:	dd67507d488a7d698eb52f709218cd7ba2875dfe
MD5 hash:	eff917e9c4e3c3c1d08e9f20ab23894f
humanhash:	sad-triple-massachusetts-nitrogen
File name:	rNBTCGROUP-NEWPURCHASEORDERS300499754.bat
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	3'835 bytes
First seen:	2026-03-03 08:30:07 UTC
Last seen:	Never
File type:	bat
MIME type:	text/plain
ssdeep	48:JQBuGoFReC7+WQQzs9+EinfdHmQeRN7y3Op6HVzMEl6U/hq0jqG4hz6NZr8jFlPg:JWuHkaA8sxCNeRN2FKElPhHj+zGknm
TLSH	T11881B8401EAB85E9535B0F24E8CE049E9D33030BECA137CE2B7863971D48959D72F8D8
Magika	txt
Reporter	FXOLabs
Tags:	bat RemcosRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

373

Origin country :

BR

Vendor Threat Intelligence

ACCE Unknown

No detections

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

_b8ca134d9a591243423531d4617faac7792011191aa05e3360a601aa34e0cfeb.txt

Verdict:

Malicious activity

Analysis date:

2026-03-03 08:32:07 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/b7e3644d-4c94-49ae-9d8e-9aa99dea0e7d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/55349/

ClamAV Detected

Detection(s):

SecuriteInfo.com.PUA.IA.Suspicious.32264542.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69a69c85002d37d5c983144a

Tags:

malware

Dr. Web vxCube Suspicious

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Launching a process

Сreating synchronization primitives

DNS request

Connection attempt

Sending a custom TCP request

Creating a file in the %AppData% directory

Using the Windows Management Instrumentation requests

Creating a process with a hidden window

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 guloader masquerade obfuscated powershell powershell

Link:

https://www.filescan.io/uploads/69a69c2291ad9169e5359de4/reports/e0e94647-e962-487d-b5f9-45e16aaeee16/overview

Hybrid Analysis PSH/Agent.ABV

Verdict:

Suspicious

Labled as:

PSH/Agent.ABV

Link:

https://www.hybrid-analysis.com/sample/b8ca134d9a591243423531d4617faac7792011191aa05e3360a601aa34e0cfeb

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

ps1

Detections:

Trojan.PowerShell.Strion.sb Trojan.PowerShell.Agent.bau

Link:

https://opentip.kaspersky.com/b8ca134d9a591243423531d4617faac7792011191aa05e3360a601aa34e0cfeb/results?tab=lookup

Nucleon Malprob Malware

Score:

98%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/b8ca134d9a591243423531d4617faac7792011191aa05e3360a601aa34e0cfeb

CERT.PL MWDB remcos

Detection:

remcos

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/b8ca134d9a591243423531d4617faac7792011191aa05e3360a601aa34e0cfeb/

Neiki Trojan.PowerShell.Strion

Verdict:

Malicious

Threat:

Trojan.PowerShell.Strion

Link:

https://tip.neiki.dev/file/b8ca134d9a591243423531d4617faac7792011191aa05e3360a601aa34e0cfeb

ReversingLabs TitaniumCloud Script-PowerShell.Trojan.GuLoader

Threat name:

Script-PowerShell.Trojan.GuLoader

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-03-03 08:30:43 UTC

File Type:

Text (Batch)

AV detection:

10 of 38 (26.32%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xdfbgtm2lejegqrvghkgc75ky54saeizdkqf4m3auya2unhaz7vq._file

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos botnet:honfire collection discovery execution persistence privilege_escalation rat

Link:

https://tria.ge/reports/260303-kecw3shz2a/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

Event Triggered Execution: Installer Packages

System Location Discovery: System Language Discovery

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses Microsoft Outlook accounts

Adds Run key to start application

Use of msiexec (install) with remote resource

Badlisted process makes network request

Detected Nirsoft tools

Remcos

Remcos family

Malware Config

C2 Extraction:

honerable.ydns.eu:50312
honerable-bk.ydns.eu:52541

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b8ca134d9a591243423531d4617faac7792011191aa05e3360a601aa34e0cfeb

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

bat b8ca134d9a591243423531d4617faac7792011191aa05e3360a601aa34e0cfeb

(this sample)

  

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/55349/