🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf13be9554f3be56b969a765990a91842d5d002bb36b541a990dc126becccae8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 15


Intelligence 15 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cf13be9554f3be56b969a765990a91842d5d002bb36b541a990dc126becccae8
SHA3-384 hash: 3347d89041cc7a97f0e37b729fc61fafc5ca1d65ead39b2d732478b444346389611186c4012241b61fc0de165535e6e1
SHA1 hash: 0f6af246ce860fc585b570b6117fd401ca7f2cc4
MD5 hash: d1769b057b14bee00c0a15692a11a14a
humanhash: red-mountain-sodium-cat
File name:rShippingDocuments.exe
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:649'264 bytes
First seen:2025-08-06 03:30:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 56a78d55f3f7af51443e58e0ce2fb5f6 (739 x GuLoader, 453 x Formbook, 295 x Loki)
ssdeep 12288:8NbPw+zOPfNKIuvJttmznTBZ+ISMfZLmi+6bSemV:8N8+zuNKIuvXtI9gMY6bSB
Threatray 71 similar samples on MalwareBazaar
TLSH T192D4F0067204C437C8504A313AE5863FE725BDDDAAD2164323B9BA7B39F168CF9067B5
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10522/11/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon 31f0acdae6f07032 (2 x RemcosRAT, 2 x GuLoader)
Reporter FXOLabs
Tags:exe RemcosRAT signed

Code Signing Certificate

Organisation:Roughener
Issuer:Roughener
Algorithm:sha256WithRSAEncryption
Valid from:2024-11-11T02:41:56Z
Valid to:2026-02-14T02:41:56Z
Serial number: 79f3d5708c82ad05f6085420c30aac428bdd1898
Thumbprint Algorithm:SHA256
Thumbprint: 598be5ff0bae1e6920f6311fc2f6073b50f530b1083c7775efc5f41c22271e2a
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
BR BR
Vendor Threat Intelligence
Malware family:
remcos
Create hunting rule
ID:
1
File name:
rShippingDocuments.exe
Verdict:
Malicious activity
Analysis date:
2025-08-06 03:32:57 UTC
Tags:
remcos rat auto-reg stealer
Link:
https://app.any.run/tasks/49cfc0c9-0bb4-47b3-bcbb-1f781db89568

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Guloader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/19117/
Detection(s):
SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.6896.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6892cc7511d7f9b979e5e2f0
Tags:
injection virus blic
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Searching for the window
Creating a file
Creating a file in the %temp% directory
Delayed reading of the file
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
adaptive-context anti-debug blackhole installer masquerade microsoft_visual_cc overlay signed
Link:
https://www.filescan.io/uploads/6892cc6d6d7bffa0a79edfb0/reports/313e9a59-aa2b-4a5f-980c-af37dc5ff4a8/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/cf13be9554f3be56b969a765990a91842d5d002bb36b541a990dc126becccae8
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/5c6b8237-d70a-4f74-953e-ba0894044771
Score:
96%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/cf13be9554f3be56b969a765990a91842d5d002bb36b541a990dc126becccae8
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PE (Portable Executable) Win 32 Exe x86
Link:
https://app.malva.re/file/d1769b057b14bee00c0a15692a11a14a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cf13be9554f3be56b969a765990a91842d5d002bb36b541a990dc126becccae8/
Threat name:
Win32.Trojan.GuLoader
Create hunting rule
Status:
Malicious
First seen:
2025-08-06 01:38:15 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
16 of 38 (42.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=z4j35fku6o7fnolju5szscurqqwv2ablwnvviguzbxasnpwmzlua._file
Verdict:
malicious
Label(s):
cloudeye
Create hunting rule
Similar samples:
0c5f6715cb9eca0d4ae9a8ee174c9022cdb4c4faa95b1924677e3dfb72cdb1f2
RemcosRAT
1a77b488a1800828543b6983bbb531e06bd95b00ea26bc2eeb2994e0f2f60236
RemcosRAT
27f53d2b44682a7c59cdb0a74f4f38cf9e32b2510cf44b6cc4c8bf144c4cd4d9
RemcosRAT
3386d940cfe8fdfc91ae97aea5ede0c1ed1aab06cd45f1fbf866bc8dcd3791db
RemcosRAT
5b7d76b1974174d10039dee319afaf8dd1cf8510c02e138109f3e9889bded8b3
RemcosRAT
afaca267e90e661941f2e7575a1102b9afc19fdcbf265d189d583e63e6357d34
RemcosRAT
bb4d04e8a442f42ae133f68747642fd2b7a8b961c3610731eb5df9a61b78f653
RemcosRAT
c4a1185ba8820bbbf9dd7945dcd223006146667df2fb49dd789f09fa99982502
RemcosRAT
c79e4f7195a1682416ec7e9289de08bde3a3a6ecf4d215a8f3df93e6a9115a01
RemcosRAT
error
RemcosRAT
f7bbce0356cb13668d6c06c9f0fe5937249d0eb471bff0e750e54fc7bb25d71a
RemcosRAT
+ 61 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:guloader family:remcos collection discovery downloader persistence rat
Link:
https://tria.ge/reports/250806-d2x27sbm4w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Detected Nirsoft tools
NirSoft MailPassView
NirSoft WebBrowserPassView
Guloader family
Guloader,Cloudeye
Remcos
Remcos family
Malware Config
C2 Extraction:
196.251.70.160:2@404
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/66ab0f79-5c00-46be-81ad-562a5ea28a4d
Unpacked files
SH256 hash:
cf13be9554f3be56b969a765990a91842d5d002bb36b541a990dc126becccae8
MD5 hash:
d1769b057b14bee00c0a15692a11a14a
SHA1 hash:
0f6af246ce860fc585b570b6117fd401ca7f2cc4
Link:
https://www.unpac.me/results/08b4e611-ffff-4598-9dcd-6053859e7edc/
SH256 hash:
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 hash:
cff85c549d536f651d4fb8387f1976f2
SHA1 hash:
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
Link:
https://www.unpac.me/results/08b4e611-ffff-4598-9dcd-6053859e7edc/
Malware family:
GuLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/cf13be9554f3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cf13be9554f3be56b969a765990a91842d5d002bb36b541a990dc126becccae8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

Executable exe cf13be9554f3be56b969a765990a91842d5d002bb36b541a990dc126becccae8

(this sample)

  
Delivery method
Distributed via e-mail attachment
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/19117/

Comments