MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba74bc113f85f02fd28e9e4a799b2e80a5b27b2c0d984d1726b76b1a9e9bb932. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ba74bc113f85f02fd28e9e4a799b2e80a5b27b2c0d984d1726b76b1a9e9bb932
SHA3-384 hash:	9fb1b2d21bc2a01bd44c09b47ef25683cbe04fadc24776c692d7311bcbf1c6beabe4780af9543685a9c70cad1f77a8f4
SHA1 hash:	601d099a34857f8c695671772dbb129baf0f7f57
MD5 hash:	dd7bf7897d392fa15da314f17e93461f
humanhash:	apart-shade-mobile-jupiter
File name:	z1EXPORTDOCS10_.bat
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	6'242 bytes
First seen:	2025-11-10 06:30:08 UTC
Last seen:	2025-11-10 08:36:58 UTC
File type:	bat
MIME type:	text/plain
ssdeep	192:x7kvqtQdTXrn2kxanFjFDU9HGBn3XbTW+:xQitQpXrn2kxanFRDcmB3u+
TLSH	T1A1D11A916CA732276EF4C57BBE4619070D341393459F01BAE6084A991B9BBDCC238D8D
Magika	txt
Reporter	FXOLabs
Tags:	bat RemcosRAT

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

84

Origin country :

BR

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

Scan Nov 9th, 2025 UAE settlement.bat

Verdict:

Suspicious activity

Analysis date:

2025-11-09 13:44:04 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/087ca73a-829d-47da-837e-86b8123fc516

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/36637/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.77735489.4188.6220.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Trojan.PS.Agent.32647.9482.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6911867ce2c9ded75d78ec61

Tags:

xtreme shell sage

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

DNS request

Connection attempt

Sending a custom TCP request

Connecting to a non-recommended domain

Sending an HTTP GET request

Creating a file in the %AppData% directory

Using the Windows Management Instrumentation requests

Creating a process with a hidden window

Using obfuscated Powershell scripts

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 obfuscated powershell

Link:

https://www.filescan.io/uploads/69118685935d9f0d73c90102/reports/8d3e2a4b-071a-4651-9e94-0a523a89e409/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/ba74bc113f85f02fd28e9e4a799b2e80a5b27b2c0d984d1726b76b1a9e9bb932

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

ps1

First seen:

2025-11-09T05:45:00Z UTC

Last seen:

2025-11-12T03:43:00Z UTC

Hits:

~1000

Detections:

HEUR:Trojan.BAT.Obfuscated.gen

Link:

https://opentip.kaspersky.com/ba74bc113f85f02fd28e9e4a799b2e80a5b27b2c0d984d1726b76b1a9e9bb932/results?tab=lookup

Nucleon Malprob Malware

Score:

98%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/ba74bc113f85f02fd28e9e4a799b2e80a5b27b2c0d984d1726b76b1a9e9bb932

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ba74bc113f85f02fd28e9e4a799b2e80a5b27b2c0d984d1726b76b1a9e9bb932/

Neiki Trojan.BAT.Obfuscated

Verdict:

Malicious

Threat:

Trojan.BAT.Obfuscated

Link:

https://tip.neiki.dev/file/ba74bc113f85f02fd28e9e4a799b2e80a5b27b2c0d984d1726b76b1a9e9bb932

ReversingLabs TitaniumCloud Script-PowerShell.Trojan.GuLoader

Threat name:

Script-PowerShell.Trojan.GuLoader

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-11-09 10:18:52 UTC

File Type:

Text

AV detection:

13 of 38 (34.21%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xj2lyej7qxyc7uuotzfhtgzoqcs3e6zmbwme2fzgw5vrvhu3xeza._file

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos collection discovery execution persistence rat

Link:

https://tria.ge/reports/251110-g9pmkscp7z/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses Microsoft Outlook accounts

Adds Run key to start application

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Detected Nirsoft tools

NirSoft MailPassView

NirSoft WebBrowserPassView

Remcos

Remcos family

Malware Config

C2 Extraction:

fteamez7iurs02.duckdns.org:12760

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/ba74bc113f85/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ba74bc113f85f02fd28e9e4a799b2e80a5b27b2c0d984d1726b76b1a9e9bb932

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

bat ba74bc113f85f02fd28e9e4a799b2e80a5b27b2c0d984d1726b76b1a9e9bb932

(this sample)

  

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/36637/