MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d25ce51a5c23df06ac177ac26091a18fda74a57bcf60391b2fdafbdfb589edb9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d25ce51a5c23df06ac177ac26091a18fda74a57bcf60391b2fdafbdfb589edb9
SHA3-384 hash:	a27cbe7ce7aa00eff2cb4d5cecf1d51999981bcd0770dbb6fa2cd09f42c3e0e7b18a89c6e2e0879f1019ee905248a367
SHA1 hash:	e04695a981d8a3d47bfda3559ed4a1ce917c98c1
MD5 hash:	f87e55b3dee36448a4be044f07b8682a
humanhash:	sweet-tennis-yellow-river
File name:	Imagenes_Referencia_Productos_Julio2025.js
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	4'180 bytes
First seen:	2025-07-29 19:25:49 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	24:ar33THtKK90h8hQ+0wTHKuxquuhPYMIxqu3K4IPKihYC3wK0Fk48MIKaU4IFxqkT:2K9r3ITnOBw
Threatray	1'052 similar samples on MalwareBazaar
TLSH	T16481A7D201F32B94E4313D50732AAD0F8E97647B6573A21CA8D7348959EFEB0D6067C5
Magika	javascript
Reporter	abuse_ch
Tags:	js RemcosRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

53

Origin country :

SE

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68892071af3050dc8d322e91

Tags:

xtreme shell lien sage

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

obfuscated

Link:

https://www.filescan.io/uploads/6889206413488cfd44df033b/reports/73244003-eb09-4853-98f0-c856c906c940/overview

Hybrid Analysis JS/TrojanDownloader.Agent

Verdict:

Malicious

Labled as:

JS/TrojanDownloader.Agent

Link:

https://www.hybrid-analysis.com/sample/d25ce51a5c23df06ac177ac26091a18fda74a57bcf60391b2fdafbdfb589edb9

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1746639

Signature

JScript performs obfuscated calls to suspicious functions

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: WScript or CScript Dropper

System process connects to network (likely due to code injection or exploit)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

95%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/d25ce51a5c23df06ac177ac26091a18fda74a57bcf60391b2fdafbdfb589edb9

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d25ce51a5c23df06ac177ac26091a18fda74a57bcf60391b2fdafbdfb589edb9/

ReversingLabs TitaniumCloud Win32.Trojan.Egairtigado

Threat name:

Win32.Trojan.Egairtigado

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-07-29 12:01:47 UTC

File Type:

Binary

AV detection:

10 of 24 (41.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2jookgs4eppqnlaxplbgbenbr7nhjjl3z5qdsgzp3l557nmj5w4q._file

Threatray purecrypter nirsoft remcos admintool_mailpassview

Verdict:

malicious

Label(s):

purecrypter

Alert

Create hunting rule

nirsoft

Alert

Create hunting rule

remcos

Alert

Create hunting rule

admintool_mailpassview

Alert

Create hunting rule

Similar samples:

0cadd7a2a02cdd71156621f83fa1164c3ef1659710b8aadca2af0740c6541059

RemcosRAT

157fc42ade8dbb632a1a8b3d9c20800401bc1f5b245719540560fcb5f09bd19a

RemcosRAT

2567bb2ba292ab96811afc9a327e2e5cdccbc021c3d4aad732a5703c0b4dfd07

RemcosRAT

491960fbf4a3f4f085b1a318c88d7f39208150b2fd11d1251bf251e912691a0b

RemcosRAT

55fe10713916a9cdac684c3a3fa263d625152a878ad98284d441b38355b57825

RemcosRAT

6c35af60300422f68dc16bbc443fc6a63190bc71a5ff1cce2e985056efad754b

RemcosRAT

81e751866842193531d97c41db2569fffd954ebf710564897145a3439e95397b

RemcosRAT

b47945f5a8a0405201cbc297352c11accfcec2f958af608ca2781fc39e98c33d

RemcosRAT

d051ba598d31d4c4d86deda039a1b6ac05fe4c21764479b9c895e641992dcc26

RemcosRAT

error

RemcosRAT

+ 1'042 additional samples on MalwareBazaar

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

execution

Link:

https://tria.ge/reports/250729-x5srfack4t/

Behaviour

Command and Scripting Interpreter: JavaScript

Blocklisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.