MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd606c5db52eec5e0fa19a8912837848e47039bb5029dc967d75dce85d06bebc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 20

Intelligence 20 IOCs YARA 9 File information Comments

SHA256 hash:	cd606c5db52eec5e0fa19a8912837848e47039bb5029dc967d75dce85d06bebc
SHA3-384 hash:	912432d05e2f1a92b0363eb695b842eb0f46de79c85362a004105ba0166c06ccada25b3ecf744f5faf61f24d886e43ba
SHA1 hash:	fafa7b25844a1faa2e39fba3bcba086b332195e8
MD5 hash:	852de9e0e00c68c04c030888e8ed4351
humanhash:	quebec-burger-charlie-ink
File name:	Backdoor.exe
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	86'016 bytes
First seen:	2026-05-24 05:33:50 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f79bdf7005a27b505da0a17f8329bd86 (19 x RemcosRAT)
ssdeep	1536:KpNEsaeiQl8TIqytzRJl+uiNuI7FFCPBsZcOzq1T35T/B2LeILtVo8V:KpNEaiQl2qouiNdFFCiZcOz+TJ/meAt
Threatray	229 similar samples on MalwareBazaar
TLSH	T16C83F707FE07C1F3E81202B20B553762AFBDEC231659A927C745C181EEB8C4AD4B567A
TrID	40.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 21.6% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 8.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 8.5% (.EXE) Win64 Executable (generic) (6522/11/2) 6.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika	pebin
dhash icon	d4a22b2e0792f0f0 (26 x RemcosRAT, 1 x NetWire)
Reporter	Anonymous
Tags:	exe RAT remcos RemcosRAT remote-access trojan

Anonymous

Remcos RAT - Remote Access Trojan C&C sinkholed - dead sample...

Intelligence

File Origin

# of uploads :

# of downloads :

333

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

Remcos

Details

Remcos

a version number and verbose configuration settings

Link:

https://research.acce.ciphertechsolutions.com/results/3d665bca-31e7-40eb-b351-fcc93e1ff65f/

Malware family:

remcos

ID:

File name:

Backdoor.exe

Verdict:

Malicious activity

Analysis date:

2026-05-24 05:18:15 UTC

Tags:

rat remcos

Link:

https://app.any.run/tasks/5b50cd37-e4cd-45e2-9423-03edde00f2d8

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Remcos

Link:

https://www.capesandbox.com/analysis/67728/

Detection(s):

Win.Trojan.Remcos-9763891-0

Win.Malware.Mikey-6843399-0

YARA.MALPEDIA_Win_Remcos_Auto.UNOFFICIAL

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a128dde33e785de369d5387

Tags:

downloader dropper rescoms remcos

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a file

Creating a window

DNS request

Connection attempt

Sending a custom TCP request

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug cmd config-extracted evasive fingerprint lolbin microsoft_visual_cc obfuscated rat rat reconnaissance remcos

Link:

https://www.filescan.io/uploads/6a128ddbefbd399b39c9ccd4/reports/ac1f038b-a8e1-4c27-b92d-b7ff2a7150d9/overview

Verdict:

Malicious

Labled as:

Remcos.Generic

Link:

https://www.hybrid-analysis.com/sample/cd606c5db52eec5e0fa19a8912837848e47039bb5029dc967d75dce85d06bebc

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-05-24T02:44:00Z UTC

Last seen:

2026-05-26T01:39:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan.Win32.Generic HEUR:Backdoor.Win32.Remcos.gen Backdoor.Win32.Remcos.sb Backdoor.Win32.Remcos.f

Link:

https://opentip.kaspersky.com/cd606c5db52eec5e0fa19a8912837848e47039bb5029dc967d75dce85d06bebc/results?tab=lookup

Malware family:

REMCOS

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/37263e81-24e8-4e9d-8a69-f9bdfdbeee4f

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/cd606c5db52eec5e0fa19a8912837848e47039bb5029dc967d75dce85d06bebc

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/852de9e0e00c68c04c030888e8ed4351

Detection:

remcos

Link:

https://mwdb.cert.pl/sample/cd606c5db52eec5e0fa19a8912837848e47039bb5029dc967d75dce85d06bebc/

Verdict:

Malicious

Threat:

Family.REMCOS

Link:

https://tip.neiki.dev/file/cd606c5db52eec5e0fa19a8912837848e47039bb5029dc967d75dce85d06bebc

Threat name:

Win32.Backdoor.Remcos

Status:

Malicious

First seen:

2026-05-24 05:34:32 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

32 of 36 (88.89%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zvqgyxnvf3wf4d5btkerfa3yjdshaon3kau5zft5oxooqxigx26a._file

Verdict:

malicious

Label(s):

remcos

RemcosRAT

6552dfa10dbb750d8fa36d567663298ea8f0b1f21668dc0ccd5b51afd82c2de3

RemcosRAT

879a2a8a7d4dd3a92ad22feb7051839b05dd4a1ff599cb71da15caab5afedbe7

RemcosRAT

8aa5bd6c413e609cebd3bf6a00bab7df51cac1487d9d4fa41ce6b0f167f9ce82

RemcosRAT

b62bd8916d40a3d7ff3f882e67109872f0a85f52bcaae0a0b5f21bed1cca7ec3

RemcosRAT

c3199df155c7d2cf49b1422f83274244ae54b5286c7c94f35f8cfe8d6105e4ef

RemcosRAT

e97671faab18edfdedb74e4623d55207d912ab1efef5423b8a6b999a43f199da

RemcosRAT

error

RemcosRAT

+ 219 additional samples on MalwareBazaar

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos botnet:remotehost discovery rat

Link:

https://tria.ge/reports/260524-f9legsby6z/

Behaviour

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

System Location Discovery: System Language Discovery

Malware Config

C2 Extraction:

greenparkhadong.com:443

Unpacked files

SH256 hash:

cd606c5db52eec5e0fa19a8912837848e47039bb5029dc967d75dce85d06bebc

MD5 hash:

852de9e0e00c68c04c030888e8ed4351

SHA1 hash:

fafa7b25844a1faa2e39fba3bcba086b332195e8

Detections:

win_remcos_auto

Link:

https://www.unpac.me/results/1e6014fa-6784-4559-a6a5-615a026e693d/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Remcos

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/cd606c5db52eec5e0fa19a8912837848e47039bb5029dc967d75dce85d06bebc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	malware_Remcos_strings Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Remcos in memory

Rule name:	Remcos Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Remcos in memory

Rule name:	Remcos Create hunting rule
Author:	kevoreilly
Description:	Remcos Payload

Rule name:	remcos_rat Create hunting rule
Author:	jeFF0Falltrades

Rule name:	REMCOS_RAT_variants Create hunting rule

Rule name:	SUSP_VBS_Wscript_Shell Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects the definition of 'Wscript.Shell' which is often used by Malware, FPs are possible and commmon

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	Windows_Generic_Threat_994f2330 Create hunting rule
Author:	Elastic Security

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.remcos.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

any.run

https://app.any.run/tasks/5b50cd37-e4cd-45e2-9423-03edde00f2d8

Dropped by

Remcos RAT

Delivery method

Multiple

Cape

https://www.capesandbox.com/analysis/67728/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample