MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d33f6bd48d7a46fa09cebad6a43f82615451d5243c143a7da6aeaebfc24aec64. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d33f6bd48d7a46fa09cebad6a43f82615451d5243c143a7da6aeaebfc24aec64
SHA3-384 hash:	15deb6885ee6457d11670c1213bef2902dc06001e9cbb3c7b90d75cf0893178f6d13c3876fec683919a61d99fb75a73e
SHA1 hash:	b74f42c4db8581f8a4c83c951eba044cba3b0be0
MD5 hash:	b7ef99a453016b7536437d381d80e43d
humanhash:	blue-stairway-nine-bluebird
File name:	MFDMACHINERY INV0303.pdf.vbs
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	455'082 bytes
First seen:	2026-07-15 07:15:48 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	12288:pUkAiTHnl9NMl7llZLGbRdO8FpJg7QfDO5YPQfd7nVa2xwo:vTAl8az
Threatray	328 similar samples on MalwareBazaar
TLSH	T1D2A42D38AEEA402A7173EF558FE474A6EA5FB673371E981D1082034B4723941EDD163E
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	vba
Reporter	abuse_ch
Tags:	RemcosRAT vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

88

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/74727/

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Agent-107.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a5733afb3055706bb554a26

Tags:

shell sage hype

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

masquerade obfuscated

Link:

https://www.filescan.io/uploads/6a5733af13ec0bd7c630ef68/reports/3d1ef843-e97c-4db5-89d3-6af51ef8f1de/overview

Hybrid Analysis VBS/Agent.TXW trojan

Verdict:

Malicious

Labled as:

VBS/Agent.TXW trojan

Link:

https://www.hybrid-analysis.com/sample/d33f6bd48d7a46fa09cebad6a43f82615451d5243c143a7da6aeaebfc24aec64

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

vbs

First seen:

2026-07-15T03:37:00Z UTC

Last seen:

2026-07-16T19:04:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/d33f6bd48d7a46fa09cebad6a43f82615451d5243c143a7da6aeaebfc24aec64/results?tab=lookup

Joe Sandbox Remcos

Result

Threat name:

Remcos

Alert

Create hunting rule

Detection:

malicious

Classification:

rans.troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1942654

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to bypass UAC (CMSTPLUA)

Contains functionality to register a low level keyboard hook

Contains functionalty to change the wallpaper

Creates an undocumented autostart registry key

Detected Remcos RAT

Found malware configuration

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Powershell scriptblock execution from environment variable

Sigma detected: Remcos

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Tries to harvest and steal browser information (history, passwords, etc)

Unusual module load detection (module proxying)

Uses an obfuscated file name to hide its real file extension (double extension)

VBScript performs obfuscated calls to suspicious functions

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

WScript reads language and country specific registry keys (likely country aware script)

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

47%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/d33f6bd48d7a46fa09cebad6a43f82615451d5243c143a7da6aeaebfc24aec64

Malva.RE Malware

Verdict:

Malware

YARA:

1 match(es)

Tags:

T1059.005 VBScript

Link:

https://app.malva.re/file/b7ef99a453016b7536437d381d80e43d

CERT.PL MWDB remcos

Detection:

remcos

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/d33f6bd48d7a46fa09cebad6a43f82615451d5243c143a7da6aeaebfc24aec64/

ReversingLabs TitaniumCloud Script.Trojan.Heuristic

Threat name:

Script.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-14 05:37:59 UTC

File Type:

Text (VBS)

AV detection:

6 of 24 (25.00%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2m7wxvenpjdpucooxllkip4cmfkfdvjehqkdu7ngv2xl7qsk5rsa._file

Threatray remcos

Verdict:

malicious

Label(s):

remcos

Alert

Create hunting rule

Similar samples:

2eabe71b18863d2044945eb371da1dbd5d12bc973538755b6177a235712db361

RemcosRAT

7550b52651ebd31c33a77f798b07c7365827ca759adfe8092de83683b27ef198

RemcosRAT

aff8f851155a1e45b120dfcf0ccd0ff9679ee0d3ae4284b09d01c88ff46b48bb

RemcosRAT

ed1427c973e2c1fecdf2536e270fec2af98e31e229fbdae6664b0e23af321f9a

RemcosRAT

error

RemcosRAT

f71da26874f86cea2cea3d3798ceb6b37bd3ee51511160828af9863fb8ff8fbf

RemcosRAT

+ 318 additional samples on MalwareBazaar

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos botnet:connect defense_evasion discovery execution persistence rat trojan

Link:

https://tria.ge/reports/260715-h3q3had19j/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Checks computer location settings

Registers new Windows logon scripts automatically executed at logon.

Badlisted process makes network request

Family: Remcos

UAC bypass

Malware Config

C2 Extraction:

game.sxglobal.qzz.io:443
165.227.80.236:443

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.33

Link:

https://yomi.yoroi.company/submissions/d33f6bd48d7a46fa09cebad6a43f82615451d5243c143a7da6aeaebfc24aec64

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/74727/