🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d0286289d581afffdd99bc47f7754cb7da99c8e9bca65ff76b9339da70c7c3aa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d0286289d581afffdd99bc47f7754cb7da99c8e9bca65ff76b9339da70c7c3aa
SHA3-384 hash: 9faa1221b67313630815bb77bf0d0192ef3ee70f0bc9977347f7aff973fea9a20b1853179b095b9793e42de17cd49ba2
SHA1 hash: 2430c5c066fad5f8d30c760e5da6c0bc988109c5
MD5 hash: ea997d10826d8f5a4b95dcf0f973c4a0
humanhash: blossom-single-spaghetti-sierra
File name:SMEU2022411686_ULJANIK_Order_Confirmation.bat
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:7'759 bytes
First seen:2026-11-10 08:04:52 UTC
Last seen:2026-11-10 09:31:21 UTC
File type:Batch (bat) bat
MIME type:text/plain
ssdeep 96:/0eoeRHWNY3EAJtK2Gve3SjdB50R5mHNhUm6+IFL2pik/JLGbLqEF4e8:N2NY3LXnGiSjdB50gNhUL+7FGiEF/8
TLSH T1F2F1BAB86689DE6DC7C7C1A6E4E959F9E7F370838A720498C5ACBB102F111DCD60D638
Magika batch
Reporter lowmal3
Tags:bat RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
80
Origin country :
AT AT
Vendor Threat Intelligence
No detections
Malware family:
remcos
Create hunting rule
ID:
1
File name:
bat
Verdict:
Malicious activity
Analysis date:
2026-11-10 12:33:56 UTC
Tags:
auto-reg rat remcos stealer mpress
Link:
https://app.any.run/tasks/1dc6a258-14a0-4b4d-8fba-2a94e19f3a42

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/98974/
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af2d04638dc20c444c37af5
Tags:
stration rapid shell sage
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/d0286289d581afffdd99bc47f7754cb7da99c8e9bca65ff76b9339da70c7c3aa
Verdict:
Malicious
File Type:
ps1
Link:
https://opentip.kaspersky.com/d0286289d581afffdd99bc47f7754cb7da99c8e9bca65ff76b9339da70c7c3aa/results?tab=lookup
Result
Threat name:
Remcos, GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/2002847
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected Remcos RAT
Disable UAC(promptonsecuredesktop)
Found malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Hides threads from debuggers
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Obfuscated command line found
Powershell connects to network
Sigma detected: Remcos
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Unusual module load detection (module proxying)
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected GuLoader
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 2002847 Sample: SMEU2022411686_ULJANIK_Orde... Startdate: 10/11/2026 Architecture: WINDOWS Score: 100 69 jpmacro-energy.duckdns.org 2->69 71 grandeur.luxe 2->71 83 Found malware configuration 2->83 85 Malicious sample detected (through community Yara rule) 2->85 87 Antivirus detection for URL or domain 2->87 91 7 other signatures 2->91 10 cmd.exe 1 2->10         started        13 powershell.exe 2->13         started        15 powershell.exe 19 2->15         started        signatures3 89 Uses dynamic DNS services 69->89 process4 signatures5 105 Suspicious powershell command line found 10->105 17 powershell.exe 1 18 10->17         started        21 conhost.exe 10->21         started        23 cmd.exe 1 10->23         started        25 powershell.exe 13->25         started        27 conhost.exe 13->27         started        29 powershell.exe 15 15->29         started        31 conhost.exe 15->31         started        process6 dnsIp7 65 grandeur.luxe 64.247.177.80, 443, 49736, 49744 LIBERTY-MOB-PR-LibertyMobilePuertoRicoIncPR United States 17->65 75 Writes to foreign memory regions 17->75 77 Found suspicious powershell code related to unpacking or dynamic code loading 17->77 79 Hides threads from debuggers 17->79 81 2 other signatures 17->81 33 backgroundTaskHost.exe 6 10 17->33         started        38 backgroundTaskHost.exe 17->38         started        40 backgroundTaskHost.exe 25->40         started        42 backgroundTaskHost.exe 25->42         started        44 backgroundTaskHost.exe 29->44         started        46 backgroundTaskHost.exe 29->46         started        signatures8 process9 dnsIp10 67 jpmacro-energy.duckdns.org 217.64.148.131, 49745, 49746, 49747 OBEHOSTINGObehostingABSE Sweden 33->67 59 C:\Users\user\AppData\...\Login Data.tmp, SQLite 33->59 dropped 61 C:\Users\user\AppData\...\Login Data.tmp, SQLite 33->61 dropped 63 C:\Users\user\...\Login Data For Account.tmp, SQLite 33->63 dropped 93 Detected Remcos RAT 33->93 95 Obfuscated command line found 33->95 97 Tries to harvest and steal browser information (history, passwords, etc) 33->97 99 Disable UAC(promptonsecuredesktop) 33->99 48 cmd.exe 1 33->48         started        51 backgroundTaskHost.exe 33->51         started        101 Unusual module load detection (module proxying) 38->101 103 Hides threads from debuggers 40->103 53 backgroundTaskHost.exe 40->53         started        file11 signatures12 process13 signatures14 73 Obfuscated command line found 48->73 55 conhost.exe 48->55         started        57 reg.exe 1 1 48->57         started        process15
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d0286289d581afffdd99bc47f7754cb7da99c8e9bca65ff76b9339da70c7c3aa/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2augfcovqgx77xmzxrd7o5kmw7njtshjxstf753lsm45u4ghyova._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery execution
Link:
https://tria.ge/reports/261110-jyx6pa1tby/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Executes a command shell one-liner
System Location Discovery: System Language Discovery
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Malware Family:
batloader
Create hunting rule
Malicious:
True
Tags:
bat persistence wmi-activity macro-powershell obfuscated debug-check exec-delay
Link:
https://intel.virussign.com/intelligence/file/d0286289d581afffdd99bc47f7754cb7da99c8e9bca65ff76b9339da70c7c3aa
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d0286289d581afffdd99bc47f7754cb7da99c8e9bca65ff76b9339da70c7c3aa

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/98974/

Comments