MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c0adb0e65a915ee89e148ac52f23c8d04a377c2e2c1209a8ddc88479b8bdfe49. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c0adb0e65a915ee89e148ac52f23c8d04a377c2e2c1209a8ddc88479b8bdfe49
SHA3-384 hash: b9b99f9a95648ba109d5fb78ec27b3ea10c799a313329e74c60fa750e269e65cb4e9f42204b9dede680d9e8d4dbe44f7
SHA1 hash: cc4d21054143987ea7ca39e951ae95f105073d6f
MD5 hash: caaefa7d1cfcfc3aa1713c1cc10e1130
humanhash: fish-speaker-pizza-harry
File name:RFQ.js
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:169'279 bytes
First seen:2026-08-04 12:56:12 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 3072:XRwtMFRiP0sS4s70uxgK5n5PHI+Ibtn+E/MFHwk0CA5sy6QtUmc:hwtMriMf7Rx7Po+IB+ZFHwk9A5w03c
TLSH T1C5F3B09196802B78FAA44FDE101D11A6D2F2F1663D2A2346FDB26F47F736D14B834A34
Magika javascript
Reporter abuse_ch
Tags:js RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
155
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cmd conhost lolbin obfuscated powershell repaired
Link:
https://www.filescan.io/uploads/6a71e1926e4125887070dcfc/reports/5b43c46d-9fb3-42f5-8287-c487d8af17f7/overview
Verdict:
Suspicious
Labled as:
JS/Agent.VCF trojan
Link:
https://www.hybrid-analysis.com/sample/c0adb0e65a915ee89e148ac52f23c8d04a377c2e2c1209a8ddc88479b8bdfe49
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
evad.rans.troj.spyw.expl
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1951940
Signature
Antivirus detection for URL or domain
Attempt to bypass Chrome Application-Bound Encryption
C2 URLs / IPs found in malware configuration
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to register a low level keyboard hook
Contains functionalty to change the wallpaper
Creates an undocumented autostart registry key
Detected Remcos RAT
Found evasive API chain checking for user administrative privileges
Found malware configuration
Found stalling execution ending in API Sleep call
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
JScript performs obfuscated calls to suspicious functions
Malicious sample detected (through community Yara rule)
Sigma detected: Potential Data Stealing Via Chromium Headless Debugging
Sigma detected: Remcos
Sigma detected: WScript or CScript Dropper
Suspicious command line found
Suspicious execution chain found
Tries to harvest and steal browser information (history, passwords, etc)
Unusual module load detection (module proxying)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
WScript reads language and country specific registry keys (likely country aware script)
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1951940 Sample: RFQ.js Startdate: 04/08/2026 Architecture: WINDOWS Score: 100 47 increvalor.com 2->47 65 Found malware configuration 2->65 67 Malicious sample detected (through community Yara rule) 2->67 69 Antivirus detection for URL or domain 2->69 71 7 other signatures 2->71 13 wscript.exe 1 1 2->13         started        signatures3 process4 signatures5 81 JScript performs obfuscated calls to suspicious functions 13->81 83 Windows Scripting host queries suspicious COM object (likely to drop second stage) 13->83 85 Suspicious execution chain found 13->85 87 WScript reads language and country specific registry keys (likely country aware script) 13->87 16 conhost.exe 13->16         started        process6 signatures7 55 Suspicious command line found 16->55 19 conhost.exe 16->19         started        process8 signatures9 73 Suspicious command line found 19->73 22 cmd.exe 1 19->22         started        process10 process11 24 powershell.exe 15 10 22->24         started        28 cmd.exe 1 22->28         started        dnsIp12 49 increvalor.com 162.241.60.182, 443, 49711 ORACLE-BMC-31898-OracleCorporationUS Brazil 24->49 75 Creates an undocumented autostart registry key 24->75 77 Writes to foreign memory regions 24->77 79 Injects a PE file into a foreign processes 24->79 30 mstsc.exe 4 9 24->30         started        signatures13 process14 dnsIp15 51 107.173.227.100, 2404, 49712, 49715 AS-COLOCROSSING-HostPapaUS United States 30->51 53 127.0.0.1 unknown unknown 30->53 39 C:\Users\user\AppData\...\cookies.sqlite-shm, data 30->39 dropped 41 C:\Users\user\AppData\...\Login Data.tmp, SQLite 30->41 dropped 43 C:\Users\user\AppData\...\Login Data.tmp, SQLite 30->43 dropped 45 C:\Users\user\...\Login Data For Account.tmp, SQLite 30->45 dropped 57 Contains functionality to bypass UAC (CMSTPLUA) 30->57 59 Detected Remcos RAT 30->59 61 Attempt to bypass Chrome Application-Bound Encryption 30->61 63 6 other signatures 30->63 35 msedge.exe 7 30->35         started        file16 signatures17 process18 process19 37 msedge.exe 35->37         started       
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/c0adb0e65a915ee89e148ac52f23c8d04a377c2e2c1209a8ddc88479b8bdfe49
Gathering data
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c0adb0e65a915ee89e148ac52f23c8d04a377c2e2c1209a8ddc88479b8bdfe49/
Threat name:
Script-JS.Downloader.RemcosRAT
Create hunting rule
Status:
Malicious
First seen:
2026-08-04 12:58:38 UTC
File Type:
Text (JavaScript)
AV detection:
10 of 24 (41.67%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ycw3bzs2sfporhqurlcs6i6i2bfdo7bofqjatkg5zcchtof57zeq._file
Verdict:
malicious
Label(s):
Remcos
Create hunting rule
Link:
https://reports.threatray.com/898a6ac8-1911-4c68-9bb7-9b1d3cf68393
Result
Malware family:
n/a
Score:
  8/10
Tags:
execution
Link:
https://tria.ge/reports/260804-p6ra1abc49/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
Executes a command shell one-liner
Checks computer location settings
Badlisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c0adb0e65a915ee89e148ac52f23c8d04a377c2e2c1209a8ddc88479b8bdfe49

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments