MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bc3256923666bf962f3a03a103716a529ef7efb58b018b4b714ce1bc4f261128. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	bc3256923666bf962f3a03a103716a529ef7efb58b018b4b714ce1bc4f261128
SHA3-384 hash:	469d973225e9a8f6d907bfb9ea2dcbc1a027a5e02285e8a52506813b882a5b786da8554421700e7871dd30c90126c167
SHA1 hash:	3776c79167040b69505fe1c9a58c4090468963df
MD5 hash:	e33fc3f86b850b2721feba3f36a20c0b
humanhash:	diet-yellow-lima-december
File name:	CopilotDriver.vbs
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	64'827 bytes
First seen:	2025-10-23 13:16:25 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	768:HiZ2erZOIa4w9Xk25HligEQkFXZqIwclaOf85wcYea4ieK2tLhligwk8grdl1Mua:U
TLSH	T16653D7CB6038CD903E186DF3E9E23A257357F1DB01F7491635A20DE0EA36494E9B79A4
Magika	vba
Reporter	abuse_ch
Tags:	RemcosRAT vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

87

Origin country :

SE

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/33886/

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68fa2acb6c859164aa6380e1

Tags:

obfuscate xtreme spawn

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 evasive obfuscated obfuscated overlay powershell

Link:

https://www.filescan.io/uploads/68fa2af53a79800405f30fb2/reports/52a278c5-e679-40e2-ab06-ef55cd330715/overview

Hybrid Analysis VBS/Obfuscated.DJ trojan

Verdict:

Malicious

Labled as:

VBS/Obfuscated.DJ trojan

Link:

https://www.hybrid-analysis.com/sample/bc3256923666bf962f3a03a103716a529ef7efb58b018b4b714ce1bc4f261128

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

vbs

First seen:

2025-10-23T08:52:00Z UTC

Last seen:

2025-10-23T09:26:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan.Script.Generic Trojan.JS.SAgent.sb

Link:

https://opentip.kaspersky.com/bc3256923666bf962f3a03a103716a529ef7efb58b018b4b714ce1bc4f261128/results?tab=lookup

Joe Sandbox Caminho Loader

Result

Threat name:

Caminho Loader

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1800606

Signature

Creates processes via WMI

Found Tor onion address

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Yara detected Caminho Loader

Yara detected Powershell download and execute

Behaviour

Behavior Graph:

Download SVG

Malva.RE Malware

Verdict:

Malware

YARA:

1 match(es)

Tags:

Scripting.FileSystemObject VBScript

Link:

https://app.malva.re/file/e33fc3f86b850b2721feba3f36a20c0b

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bc3256923666bf962f3a03a103716a529ef7efb58b018b4b714ce1bc4f261128/

Neiki Family.REMCOS

Verdict:

Malicious

Threat:

Family.REMCOS

Link:

https://tip.neiki.dev/file/bc3256923666bf962f3a03a103716a529ef7efb58b018b4b714ce1bc4f261128

ReversingLabs TitaniumCloud Win32.Trojan.Egairtigado

Threat name:

Win32.Trojan.Egairtigado

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-10-23 13:18:27 UTC

File Type:

Binary

AV detection:

9 of 24 (37.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xqzfnerwm27zmlz2aoqqg4lkkkppp35vrmayws3rjtq3ytzgceua._file

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos discovery execution rat

Link:

https://tria.ge/reports/251023-qjgcysdw6c/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Process spawned unexpected child process

Remcos

Remcos family

Malware Config

C2 Extraction:

systemcopilotdriver.ydns.eu:3001

Dropper Extraction:

http://archive.org/download/optimized_msi_20251021_2144/optimized_MSI.png

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/bc3256923666bf962f3a03a103716a529ef7efb58b018b4b714ce1bc4f261128

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

vbs bc3256923666bf962f3a03a103716a529ef7efb58b018b4b714ce1bc4f261128

(this sample)

  

URLhaus

https://urlhaus.abuse.ch/url/3560095/

  

Delivery method

Distributed via web download

  

URLhaus

https://urlhaus.abuse.ch/url/3560098/

Cape

https://www.capesandbox.com/analysis/33886/