MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d416e266233c918414e743cf4ecb4c5c5f9129316fff75267820181c06cfbfe3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 12


Intelligence 12 IOCs YARA 24 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d416e266233c918414e743cf4ecb4c5c5f9129316fff75267820181c06cfbfe3
SHA3-384 hash: 10db587b514f60e5a473209dba9e56c1b5730e8664292d2066011e2b382b5f59932332a4f234adff5bd0b3be752cf762
SHA1 hash: edcbc8827e68f7b875dbe34e918adad56e76c5a9
MD5 hash: df256834a12817bcfffe280b4bee1cd9
humanhash: four-vegan-beryllium-sixteen
File name:TT WIRE INSTRUCTION FORM.VBE
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:2'892'700 bytes
First seen:2025-10-21 05:12:29 UTC
Last seen:Never
File type:Visual Basic Script (vbe) vbe
MIME type:text/plain
ssdeep 24576:Fz4x56E3/6cF+r0b3zx4EfYaFfAJNAyhHPF+Z+HdFkoZNGR2xr2qUXsJRC/fbcyE:gvFyCYaVKF+QTk86BT1KNb7C6
TLSH T13DD5021589C42FB9CFAC5A1890FE161E93E04A8E545B758AFB37BD4BAFFB504010B1D8
Magika vba
Reporter abuse_ch
Tags:RAT RemcosRAT vbe

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
SE SE
Vendor Threat Intelligence
Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68f71643ad6ce0f5ad403784
Tags:
vmdetect lien
Gathering data
Verdict:
Malicious
Labled as:
GT:VB.Zbot.9
Link:
https://www.hybrid-analysis.com/sample/d416e266233c918414e743cf4ecb4c5c5f9129316fff75267820181c06cfbfe3
Verdict:
Malicious
File Type:
text
First seen:
2025-10-20T23:17:00Z UTC
Last seen:
2025-10-22T21:36:00Z UTC
Hits:
~1000
Detections:
Backdoor.Win32.Remcos.f PDM:Trojan.Win32.Generic HEUR:Trojan.Script.Generic Backdoor.Remcos.HTTP.C&C Trojan.JS.SAgent.sb HEUR:Worm.Script.Generic Trojan.Win32.Inject.sb Trojan.PowerShell.Cobalt.sb HEUR:Trojan-Downloader.Script.Generic Exploit.Win32.BypassUAC.sb Backdoor.Win32.Remcos.sb
Link:
https://opentip.kaspersky.com/d416e266233c918414e743cf4ecb4c5c5f9129316fff75267820181c06cfbfe3/results?tab=lookup
Result
Threat name:
Remcos, Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1798839
Signature
AI detected malicious Powershell script
Antivirus detection for dropped file
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Delayed program exit found
Detected Remcos RAT
Found malware configuration
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Sigma detected: Remcos
Sigma detected: Suspicious Child Process of AspNetCompiler
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses dynamic DNS services
Uses the Telegram API (likely for C&C communication)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Yara detected Powershell decode and execute
Yara detected Remcos RAT
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1798839 Sample: TT WIRE INSTRUCTION FORM.VBE.vbe Startdate: 21/10/2025 Architecture: WINDOWS Score: 100 49 tooblessed2bcursed.duckdns.org 2->49 51 reallyfreegeoip.org 2->51 53 4 other IPs or domains 2->53 73 Suricata IDS alerts for network traffic 2->73 75 Found malware configuration 2->75 77 Malicious sample detected (through community Yara rule) 2->77 83 14 other signatures 2->83 10 wscript.exe 1 2->10         started        signatures3 79 Uses dynamic DNS services 49->79 81 Tries to detect the country of the analysis system (by using the IP) 51->81 process4 signatures5 95 Windows Scripting host queries suspicious COM object (likely to drop second stage) 10->95 97 Suspicious execution chain found 10->97 13 cscript.exe 5 10->13         started        process6 file7 39 C:\Users\user\AppData\...\system_update.ps1, ASCII 13->39 dropped 41 C:\Temp\Y8qkdACknOZc_4772461.ps1, ASCII 13->41 dropped 99 Suspicious powershell command line found 13->99 101 Bypasses PowerShell execution policy 13->101 17 powershell.exe 16 13->17         started        20 conhost.exe 13->20         started        signatures8 process9 signatures10 61 Writes to foreign memory regions 17->61 63 Injects a PE file into a foreign processes 17->63 22 aspnet_compiler.exe 2 8 17->22         started        27 aspnet_compiler.exe 17->27         started        29 aspnet_compiler.exe 17->29         started        31 3 other processes 17->31 process11 dnsIp12 55 196.251.92.42, 29116, 49694, 49696 Web4AfricaZA Seychelles 22->55 57 127.0.0.1 unknown unknown 22->57 59 2 other IPs or domains 22->59 37 C:\Users\user\AppData\Local\Temp\dwn.exe, PE32 22->37 dropped 85 Detected Remcos RAT 22->85 33 dwn.exe 15 2 22->33         started        87 Contains functionalty to change the wallpaper 27->87 89 Contains functionality to steal Chrome passwords or cookies 27->89 91 Contains functionality to register a low level keyboard hook 27->91 93 2 other signatures 27->93 file13 signatures14 process15 dnsIp16 43 api.telegram.org 149.154.167.220, 443, 49713 TELEGRAMRU United Kingdom 33->43 45 checkip.dyndns.com 158.101.44.242, 49698, 49700, 49702 ORACLE-BMC-31898US United States 33->45 47 reallyfreegeoip.org 172.67.177.134, 443, 49699, 49701 CLOUDFLARENETUS United States 33->47 65 Antivirus detection for dropped file 33->65 67 Multi AV Scanner detection for dropped file 33->67 69 Tries to steal Mail credentials (via file / registry access) 33->69 71 Tries to harvest and steal browser information (history, passwords, etc) 33->71 signatures17
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/d416e266233c918414e743cf4ecb4c5c5f9129316fff75267820181c06cfbfe3
Verdict:
Malware
YARA:
2 match(es)
Tags:
ADODB.Stream Batch Command MSXML2.DOMDocument.6.0 PowerShell PowerShell Call Scripting.FileSystemObject VBScript WScript.Shell
Link:
https://app.malva.re/file/df256834a12817bcfffe280b4bee1cd9
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d416e266233c918414e743cf4ecb4c5c5f9129316fff75267820181c06cfbfe3/
Verdict:
Malicious
Threat:
Backdoor.Win32.Remcos
Link:
https://tip.neiki.dev/file/d416e266233c918414e743cf4ecb4c5c5f9129316fff75267820181c06cfbfe3
Threat name:
Win32.Infostealer.Zeus
Create hunting rule
Status:
Malicious
First seen:
2025-10-21 03:44:45 UTC
File Type:
Text (VBS)
AV detection:
7 of 24 (29.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2qloezrdhsiyifhhiphu5s2mlrpzckjrn77xkjtyeambybwpx7rq._file
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:remcos family:snakekeylogger botnet:remotehost collection defense_evasion discovery execution keylogger persistence rat spyware stealer
Link:
https://tria.ge/reports/251021-fv5vks1pdp/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Detected Nirsoft tools
NirSoft MailPassView
NirSoft WebBrowserPassView
Remcos
Remcos family
Snake Keylogger
Snake Keylogger payload
Snakekeylogger family
Malware Config
C2 Extraction:
127.0.0.1:29116
tooblessed2bcursed.duckdns.org:29116
196.251.92.42:29116
https://api.telegram.org/bot8494379124:AAEY3MdJGkCMgmZrdqmOQqDlNSX4PoijlCU/sendMessage?chat_id=7788030038
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d416e266233c918414e743cf4ecb4c5c5f9129316fff75267820181c06cfbfe3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Base64_Encoded_Powershell_Directives
Create hunting rule
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:detect_tiny_vbs
Create hunting rule
Author:daniyyell
Description:Detects tiny VBS delivery technique
Rule name:dgaaga
Create hunting rule
Author:Harshit
Description:Detects suspicious PowerShell or registry activity
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:iexplorer_remcos
Create hunting rule
Author:iam-py-test
Description:Detect iexplorer being taken over by Remcos
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Remcos
Create hunting rule
Author:kevoreilly
Description:Remcos Payload
Rule name:REMCOS_RAT_variants
Create hunting rule
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:Windows_Trojan_Remcos_b296e965
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set
Rule name:win_remcos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.remcos.
Rule name:win_remcos_rat_unpacked
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in remcos rat Samples.
Rule name:win_remcos_w0
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in remcos rat Samples.
Rule name:yarahub_win_remcos_rat_unpacked_aug_2023
Create hunting rule
Author:Matthew @ Embee_Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments