MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8d9098cd559f1cad2b5822c4f41a0e1d105878a95650967539014826a856220. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 18

Intelligence 18 IOCs YARA 27 File information Comments

SHA256 hash:	b8d9098cd559f1cad2b5822c4f41a0e1d105878a95650967539014826a856220
SHA3-384 hash:	71420233d910f930755b2077e7bc32cb9bd183f705426b368c426434457375baf716fa5836f18458328325ad46e07dc4
SHA1 hash:	b4a3a47ef111b05e5f9b2afbcdf23cb0df01dac9
MD5 hash:	711549a85829bdee279a0eb904a5003b
humanhash:	georgia-massachusetts-five-wisconsin
File name:	b8d9098cd559f1cad2b5822c4f41a0e1d105878a95650967539014826a856220
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	1'361'920 bytes
First seen:	2025-09-05 13:03:51 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	1895460fffad9475fda0c84755ecfee1 (308 x Formbook, 52 x AgentTesla, 36 x SnakeKeylogger)
ssdeep	24576:N5EmXFtKaL4/oFe5T9yyXYfP1ijXdaqBNaKo9pItk7zp2Xcq+wO:NPVt/LZeJbInQRaqrE/ohO
Threatray	4'126 similar samples on MalwareBazaar
TLSH	T19255CF0273D1D062FFAB92334F56F6115ABC79260123AA1F13981DB9BE701B1563E7A3
TrID	40.3% (.EXE) Win64 Executable (generic) (10522/11/4) 19.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 17.2% (.EXE) Win32 Executable (generic) (4504/4/1) 7.7% (.EXE) OS/2 Executable (generic) (2029/13) 7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	adrian__luca
Tags:	exe RemcosRAT

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

b8d9098cd559f1cad2b5822c4f41a0e1d105878a95650967539014826a856220

Verdict:

Malicious activity

Analysis date:

2025-09-05 19:11:17 UTC

Tags:

auto-startup

Link:

https://app.any.run/tasks/ecd68395-a626-4157-ae59-1f1e95e22c96

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Remcos

Link:

https://www.capesandbox.com/analysis/25555/

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68badfeaeb163e0ec18481a9

Tags:

autorun autoit emotet

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% directory

Creating a file

Creating a process from a recently created file

Launching a process

Сreating synchronization primitives

DNS request

Connection attempt

Sending an HTTP GET request

Connection attempt to an infection source

Sending a TCP request to an infection source

Enabling autorun by creating a file

Unauthorized injection to a system process

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context autoit compiled-script extrac32 fingerprint keylogger lolbin microsoft_visual_cc mmc obfuscated packed packed packer_detected threat

Link:

https://www.filescan.io/uploads/68baea9e20d0ee406d96b7fb/reports/83a5c678-a16b-46a7-b3fd-394ea3222b60/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/b8d9098cd559f1cad2b5822c4f41a0e1d105878a95650967539014826a856220

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-08-20T01:16:00Z UTC

Last seen:

2025-08-20T01:16:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/b8d9098cd559f1cad2b5822c4f41a0e1d105878a95650967539014826a856220/results?tab=lookup

Malware family:

REMCOS

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/68638620-e43e-4b80-a538-b9d5395d7e41

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/b8d9098cd559f1cad2b5822c4f41a0e1d105878a95650967539014826a856220

Verdict:

Malware

YARA:

7 match(es)

Tags:

AutoIt Decompiled Executable PDB Path PE (Portable Executable) PE File Layout Suspect Win 32 Exe x86

Link:

https://app.malva.re/file/711549a85829bdee279a0eb904a5003b

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b8d9098cd559f1cad2b5822c4f41a0e1d105878a95650967539014826a856220/

Threat name:

Win32.Trojan.AutoitInject

Status:

Malicious

First seen:

2025-08-20 05:10:31 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

28 of 36 (77.78%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=xdmqtdgvlhy4vuvvqiwe6qna4hiqlb4ksvsqsz2tsakie2ufmiqa._file

Verdict:

malicious

Label(s):

remcos

RemcosRAT

0638614da4d1a0cbaa5044df28915bf50ed5aee1ad9dcbf5d66da4d4f859e735

RemcosRAT

09ed77b7dcd2dcff435a3c045a419e82671ee6e4cefb1a988e52f4266ee970cb

RemcosRAT

200eca54c7f6341b7df45fda4062dfd87c141ce38325adebf1bd79f1a4615d8e

RemcosRAT

6981d8702172dc39f302bdeb4917c0eb49f7c37b2a90bee41f64ccecc7e9497d

RemcosRAT

8af1b5d9eb0c5925009f07824184d5d7e1f4f02f253135d63e51590e87269441

RemcosRAT

ae016e4375fd5a26f3a6694090d6d4acdef0ad2e1a6b655245edaba423326207

RemcosRAT

+ 4'116 additional samples on MalwareBazaar

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos botnet:remotehost discovery rat

Link:

https://tria.ge/reports/250905-q46tcaxns6/

Behaviour

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Program crash

System Location Discovery: System Language Discovery

AutoIT Executable

Suspicious use of SetThreadContext

Drops startup file

Executes dropped EXE

Remcos

Remcos family

Malware Config

C2 Extraction:

198.12.126.169:8787

Verdict:

Malicious

Tags:

Remcos

YARA:

n/a

Link:

https://app.threat.zone/submission/174bca1a-0108-4fd7-a897-daaa68e81cfb

Unpacked files

SH256 hash:

545671e66fb4496793dc4b1fc5af753c615c6c9fef295a6338d01065b0666876

MD5 hash:

f4ce70b4579d006922c48752b7857afb

SHA1 hash:

bb2547d905dbad0987054de67b48c53e9ef987c4

Detections:

win_remcos_w0

win_remcos_auto

Remcos

malware_windows_remcos_rat

win_remcos_rat_unpacked

INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer

Link:

https://www.unpac.me/results/c26e1364-f746-4be3-9bfe-02f3a081b022/

Parent samples :

0ce45ef5e6b470b80e4c7079377953db80ecfc5393fb76ee4568fa334c613924
ed17eb2e83fcca67ba66de21c6357ed58d2c684793aa0e7364e120c189488a6e
b8d9098cd559f1cad2b5822c4f41a0e1d105878a95650967539014826a856220
a4469de201ddfb4d5102a3cfeb04974284a9469074ebe6e4859baead0685154a
3e5dc24c78b7e9adf091d621235f04be8b83a31cdcbe635865c4f6453c4b59b9
89294d5c1a033154e10fd604877db9a4b80f48bde81b1c72639fe36fbf0c224a
5376f3fdc59befa0e3af575beb1ca43180a9edceae0a26eba338aa2b1ca37953
4692619ce40d97bef76e23478bb66e119fef350b7ca0024163fdb335b91420fa
e16e382a86bb0930cf4dfa72fea34e7f65948d9ebf669b8282fd9405aea737d5

SH256 hash:

b8d9098cd559f1cad2b5822c4f41a0e1d105878a95650967539014826a856220

MD5 hash:

711549a85829bdee279a0eb904a5003b

SHA1 hash:

b4a3a47ef111b05e5f9b2afbcdf23cb0df01dac9

Link:

https://www.unpac.me/results/c26e1364-f746-4be3-9bfe-02f3a081b022/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b8d9098cd559f1cad2b5822c4f41a0e1d105878a95650967539014826a856220

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	iexplorer_remcos Create hunting rule
Author:	iam-py-test
Description:	Detect iexplorer being taken over by Remcos

Rule name:	INDICATOR_EXE_Packed_MPress Create hunting rule
Author:	ditekSHen
Description:	Detects executables built or packed with MPress PE compressor

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer Create hunting rule
Author:	ditekSHen
Description:	detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	nirsoft_v1 Create hunting rule
Author:	RandomMalware

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Remcos Create hunting rule
Author:	kevoreilly
Description:	Remcos Payload

Rule name:	remcos_ Create hunting rule
Author:	Michelle Khalil
Description:	This rule detects unpacked remcos malware samples.

Rule name:	REMCOS_RAT_variants Create hunting rule

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	TeslaCryptPackedMalware Create hunting rule

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Windows_Trojan_Remcos_b296e965 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.remcos.

Rule name:	win_remcos_rat_unpacked Create hunting rule
Author:	Matthew @ Embee_Research
Description:	Detects strings present in remcos rat Samples.

Rule name:	win_remcos_w0 Create hunting rule
Author:	Matthew @ Embee_Research
Description:	Detects strings present in remcos rat Samples.

Rule name:	yarahub_win_remcos_rat_unpacked_aug_2023 Create hunting rule
Author:	Matthew @ Embee_Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/25555/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample