MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d65c7d2e8c2336f34fc84f6f61a9e1e55c58e0fef0bafbd8b45348d16bb8b591. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d65c7d2e8c2336f34fc84f6f61a9e1e55c58e0fef0bafbd8b45348d16bb8b591
SHA3-384 hash:	37443e9f365641b6ec96edfe821701bb432fc99b44d22387194d424854f56e19e8dc6e9c9a7259ba5bff6ac52e4d5c83
SHA1 hash:	6435be9b85b5d3360e545f4a17d3754a61def53d
MD5 hash:	6d78f0fab6a63a45fecddfb6e6bc004f
humanhash:	princess-johnny-kitten-michigan
File name:	pleaseviewstampedimageandconfirmourorder_Doc12234567754_678787899 pdf.js
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	2'444 bytes
First seen:	2025-04-23 16:19:07 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	48:FjtlMQuqmwhhtn/UUtne4hyjyyURULBWrrtnl8UGuqJbguqh9guqO/guqxbguqBc:xtlMQujwhhtn/UUtne4hyjyyURULBWr8
Threatray	4'231 similar samples on MalwareBazaar
TLSH	T13251691208E15F1A0D2085845DB7D0B79BB5C6E1588E7F0E730EE889FA331B95DFAC29
Magika	javascript
Reporter	Anonymous
Tags:	js RemcosRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

454

Origin country :

US

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Other.Malware-gen.24028.17402.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6809143c3d067f84839870ba

Tags:

obfuscate xtreme shell

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

masquerade obfuscated

Link:

https://www.filescan.io/uploads/68091387237e42b9b329ee3e/reports/b719d600-8925-4da8-9bf3-36040ba97003/overview

Hybrid Analysis Trojan.Script.Heuristic

Verdict:

Malicious

Labled as:

Trojan.Script.Heuristic

Link:

https://www.hybrid-analysis.com/sample/d65c7d2e8c2336f34fc84f6f61a9e1e55c58e0fef0bafbd8b45348d16bb8b591

Joe Sandbox Remcos

Result

Threat name:

Remcos

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1672280

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Connects to a pastebin service (likely for C&C)

Connects to many ports of the same IP (likely port scanning)

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Delayed program exit found

Detected Remcos RAT

Found malware configuration

Injects a PE file into a foreign processes

Installs a global keyboard hook

JavaScript source code contains functionality to generate code involving HTTP requests or file downloads

Joe Sandbox ML detected suspicious sample

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Remcos

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: Silenttrinity Stager Msbuild Activity

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

System process connects to network (likely due to code injection or exploit)

Uses dynamic DNS services

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected Powershell decode and execute

Yara detected Powershell download and execute

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

53%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/d65c7d2e8c2336f34fc84f6f61a9e1e55c58e0fef0bafbd8b45348d16bb8b591

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d65c7d2e8c2336f34fc84f6f61a9e1e55c58e0fef0bafbd8b45348d16bb8b591/

ReversingLabs TitaniumCloud Script-JS.Trojan.Heuristic

Threat name:

Script-JS.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-04-23 13:06:47 UTC

File Type:

Text

AV detection:

9 of 24 (37.50%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2zoh2lumem3pgt6ij5xwdkpb4vofryh66c5pxwfuknenc25ywwiq._file

Threatray remcos

Verdict:

malicious

Label(s):

remcos

Alert

Create hunting rule

Similar samples:

471319aad8312f3f5da24f6366c3fd68698cfcd2b19db31d2209f14212760296

RemcosRAT

5b9a611f5ca531f0794cf9601360e1414c72079689ce107c2ebf4c5bb6fc5f8d

RemcosRAT

909c33d6348be0cf34686e22658f9957c57ca0dfdcd47c1000e6b0ec61502547

RemcosRAT

923b51a8e59ac5dc4db026988ec3f205f21cbb6590cd14b0e68b9cb0d8114ad7

RemcosRAT

9ec800488905166dc740c5c7513eb39d49c9a65ae6981b5df117fba7e3266025

RemcosRAT

b0f580611f79b3506b8ffcb745951d7de5811d3f91261d1fc08b247c32649688

RemcosRAT

baa92cdc50fba4cec0928b6b1f7d1b89611dedfb9ddb2f1bef9236bc0422c460

RemcosRAT

e4293a8a871f20b700e122619df9fc6f3dff076df4180f89a59f3f959d9140f1

RemcosRAT

eef9fb028bbb5cbf39b27857e9f0461a51c60660baf88348be7c1c74eaeb0e0d

RemcosRAT

error

RemcosRAT

+ 4'221 additional samples on MalwareBazaar

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos botnet:april discovery execution rat

Link:

https://tria.ge/reports/250423-tsk92ssvf1/

Behaviour

Script User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Checks computer location settings

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Remcos

Remcos family

Malware Config

C2 Extraction:

dum555.duckdns.org:31679

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.28

Link:

https://yomi.yoroi.company/submissions/d65c7d2e8c2336f34fc84f6f61a9e1e55c58e0fef0bafbd8b45348d16bb8b591