MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b9ddd7911daf8a8d71a31e87bdf7cc96ae29c53b28ba508f7a4b48e6fe081a96. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 14


Intelligence 14 IOCs YARA 33 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b9ddd7911daf8a8d71a31e87bdf7cc96ae29c53b28ba508f7a4b48e6fe081a96
SHA3-384 hash: 3e01fa7a32e521030ab7927978ce556d3ccbbe45464577c69c131f8f0018a16b346ca871aa481a88cefdd5ed85291410
SHA1 hash: 6186851970e70b8f5edc924ac0a4af197da8ebc9
MD5 hash: e0e5c672c07ec607cea9fa57afcd8c81
humanhash: nebraska-hawaii-don-uncle
File name:GRT65455768866876577575555555571756700233.bat
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:817'024 bytes
First seen:2025-09-01 16:16:43 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/plain
ssdeep 12288:v93GGfdUeCJbdEMQoYX/1KXUN0ZpwJ3nuPJnGm3guqQNyHY/oNu2D0vHFmmp2u64:vpG5BJbaQ49RePJnGKgF2oN7I8mD670
Threatray 852 similar samples on MalwareBazaar
TLSH T1E805D03EDAB1ACE4032EB0D0516E3F57209C4F63E2712B6CB1D515BA1995645EF3B28C
Magika batch
Reporter smica83
Tags:bat RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
GRT65455768866876577575555555571756700233.bat
Verdict:
No threats detected
Analysis date:
2025-09-01 16:22:19 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/7925b766-886e-42b4-99b6-f7ef704f58cc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Remcos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/24596/
Detection(s):
SecuriteInfo.com.BAT.Agent-38.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68b5c700eb163e0ec18418ec
Tags:
autorun lien
Verdict:
Suspicious
Labled as:
BAT/Agent.AZY
Link:
https://www.hybrid-analysis.com/sample/b9ddd7911daf8a8d71a31e87bdf7cc96ae29c53b28ba508f7a4b48e6fe081a96
Verdict:
Malicious
File Type:
unix shell
First seen:
2025-09-01T01:55:00Z UTC
Last seen:
2025-09-01T01:55:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/b9ddd7911daf8a8d71a31e87bdf7cc96ae29c53b28ba508f7a4b48e6fe081a96/results?tab=lookup
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1769077
Signature
.NET source code contains a sample name check
.NET source code references suspicious native API functions
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Detected Remcos RAT
Drops script or batch files to the startup folder
Found hidden mapped module (file has been removed from disk)
Found malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Powershell drops PE file
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Drops script at startup location
Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: PowerShell Base64 Encoded IEX Cmdlet
Sigma detected: Remcos
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Writes to foreign memory regions
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Yara detected WebBrowserPassView password recovery tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1769077 Sample: GRT654557688668765775755555... Startdate: 01/09/2025 Architecture: WINDOWS Score: 100 105 wormoni.lms-austria.com 2->105 107 geoplugin.net 2->107 113 Suricata IDS alerts for network traffic 2->113 115 Found malware configuration 2->115 117 Malicious sample detected (through community Yara rule) 2->117 119 16 other signatures 2->119 10 cmd.exe 1 2->10         started        13 cmd.exe 1 2->13         started        15 cmd.exe 2->15         started        17 16 other processes 2->17 signatures3 process4 signatures5 125 Suspicious powershell command line found 10->125 19 cmd.exe 1 10->19         started        21 conhost.exe 10->21         started        24 cmd.exe 1 13->24         started        26 conhost.exe 13->26         started        28 cmd.exe 15->28         started        30 conhost.exe 15->30         started        32 cmd.exe 17->32         started        34 cmd.exe 17->34         started        36 30 other processes 17->36 process6 signatures7 38 cmd.exe 3 19->38         started        121 Suspicious powershell command line found 21->121 41 cmd.exe 2 24->41         started        43 cmd.exe 28->43         started        45 cmd.exe 32->45         started        47 cmd.exe 34->47         started        49 cmd.exe 36->49         started        51 cmd.exe 36->51         started        53 cmd.exe 36->53         started        55 11 other processes 36->55 process8 signatures9 123 Suspicious powershell command line found 38->123 57 2 other processes 38->57 62 2 other processes 41->62 64 2 other processes 43->64 66 2 other processes 45->66 68 2 other processes 47->68 70 2 other processes 49->70 72 2 other processes 51->72 74 2 other processes 53->74 76 22 other processes 55->76 process10 dnsIp11 109 wormoni.lms-austria.com 192.145.124.5, 49718, 49719, 60736 M247GB Romania 57->109 111 geoplugin.net 178.237.33.50, 49720, 80 ATOM86-ASATOM86NL Netherlands 57->111 101 8 other malicious files 57->101 dropped 127 Drops script or batch files to the startup folder 57->127 129 Writes to foreign memory regions 57->129 131 Found hidden mapped module (file has been removed from disk) 57->131 135 5 other signatures 57->135 78 RmClient.exe 1 57->78         started        81 RmClient.exe 57->81         started        83 RmClient.exe 57->83         started        85 3 other processes 57->85 87 C:\Users\user\AppData\Roaming\...\1a70.bat, ASCII 62->87 dropped 89 C:\Users\user\AppData\Roaming\...\6c64.bat, ASCII 64->89 dropped 91 C:\Users\user\AppData\Roaming\...\9a71.bat, ASCII 66->91 dropped 93 C:\Users\user\AppData\Roaming\...\3bab.bat, ASCII 68->93 dropped 95 C:\Users\user\AppData\Roaming\...\3823.bat, ASCII 70->95 dropped 97 C:\Users\user\AppData\Roaming\...\ff2c.bat, ASCII 72->97 dropped 99 C:\Users\user\AppData\Roaming\...\0fe2.bat, ASCII 74->99 dropped 103 11 other malicious files 76->103 dropped 133 Detected Remcos RAT 76->133 file12 signatures13 process14 signatures15 137 Tries to steal Instant Messenger accounts or passwords 78->137 139 Tries to steal Mail credentials (via file / registry access) 78->139 141 Tries to harvest and steal browser information (history, passwords, etc) 83->141 143 Tries to steal Mail credentials (via file registry) 85->143
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/b9ddd7911daf8a8d71a31e87bdf7cc96ae29c53b28ba508f7a4b48e6fe081a96
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b9ddd7911daf8a8d71a31e87bdf7cc96ae29c53b28ba508f7a4b48e6fe081a96/
Threat name:
Script-BAT.Backdoor.Remcos
Create hunting rule
Status:
Suspicious
First seen:
2025-09-01 06:58:56 UTC
File Type:
Text
AV detection:
11 of 38 (28.95%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xho5pei5v6fi24ndd2d3356ms2xctrj3fc5fbd32jneon7qidkla._file
Verdict:
malicious
Label(s):
nirsoft
Create hunting rule
remcos
Create hunting rule
donut_injector
Create hunting rule
Similar samples:
01a7e3e696ee5e09a12a71808c7c07a46f256378b74c13b847f6e2838c509470
RemcosRAT
06a4f5872145608425c3b41c01ee00f6b20986236d673ec5319184cc68a029e5
RemcosRAT
4b052c0a60681008a7ebd4b9797badf24129a8710c0ec56fe560c14c61c44f79
RemcosRAT
6f5bd4915a2e39198fa74aa7dd6e31f2398f581ca6d88437b6d9c3978b29aa10
RemcosRAT
cc1b38c4aa79c03c777b0d99c9ae67fef380572e36f0744d110c18137ce9f3dd
RemcosRAT
d25ce51a5c23df06ac177ac26091a18fda74a57bcf60391b2fdafbdfb589edb9
RemcosRAT
e1a0ab5cadb0af718230bb8f907c649a313f1ff7bcbed6745c678811ce8a4465
RemcosRAT
error
RemcosRAT
fb51ffcffd134849ebc6114eacc45a0bd9f2430188fd33064217df5b4cd41508
RemcosRAT
+ 842 additional samples on MalwareBazaar
Result
Malware family:
donutloader
Create hunting rule
Score:
  10/10
Tags:
family:donutloader collection discovery execution loader
Link:
https://tria.ge/reports/250901-trgkgabn8w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Command and Scripting Interpreter: PowerShell
Drops startup file
Badlisted process makes network request
Detected Nirsoft tools
NirSoft MailPassView
NirSoft WebBrowserPassView
Detects DonutLoader
DonutLoader
Donutloader family
Malware family:
WebBrowserPassView
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b9ddd7911daf/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b9ddd7911daf8a8d71a31e87bdf7cc96ae29c53b28ba508f7a4b48e6fe081a96

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:botnet_plaintext_c2
Create hunting rule
Author:cip
Description:Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_EXE_Packed_MPress
Create hunting rule
Author:ditekSHen
Description:Detects executables built or packed with MPress PE compressor
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Author:ditekSHen
Description:Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:remcos_
Create hunting rule
Author:Michelle Khalil
Description:This rule detects unpacked remcos malware samples.
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:Remcos_unpacked_PulseIntel
Create hunting rule
Author:PulseIntel
Description:Remcos Payload
Rule name:SUSP_PS1_JAB_Pattern_Jun22_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects suspicious UTF16 and Base64 encoded PowerShell code that starts with a $ sign and a single char variable
Reference:Internal Research
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:TeslaCryptPackedMalware
Create hunting rule
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Windows_Trojan_Remcos_b296e965
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.remcos.
Rule name:win_remcos_rat_unpacked
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in remcos rat Samples.
Rule name:win_remcos_w0
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in remcos rat Samples.
Rule name:yarahub_win_remcos_rat_unpacked_aug_2023
Create hunting rule
Author:Matthew @ Embee_Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/24596/

Comments