MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d92f3155a058d19c81eba292df6fa7d5080c684ba6a19d3d04d2bdd24796d53c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d92f3155a058d19c81eba292df6fa7d5080c684ba6a19d3d04d2bdd24796d53c
SHA3-384 hash:	8be5c5f6c1b302cdd37061f5563ff269aa83b98bbe6afb395665e9be2fec6c982aa69fc22f95148cbca7d3fe979cffe2
SHA1 hash:	9528156ff8ba6b0cdd213fd53fc5c18aa45648c7
MD5 hash:	b18de8172c17deda9dcb66685d4059f6
humanhash:	coffee-neptune-magnesium-maine
File name:	MV DRY VOYAGER 1 Ship.Partic.pdf.js
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	1'817'876 bytes
First seen:	2026-07-11 07:05:33 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	12288:Dw5AZ3iyBUNxQSE9U761wZ1VUSf636OzAnuyVonlyO1GTnB3lYme:hiUUNxQyYme
Threatray	41 similar samples on MalwareBazaar
TLSH	T19C856F68CB2AD11218336EA4BCA97847FDEEFF25337E494141564708C22358EEE58F6D
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	txt
Reporter	abuse_ch
Tags:	js RemcosRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

131

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.JS.Obfus-417.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a51ec63a900f0e9eb6bfcc8

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

conhost encrypted evasive lolbin masquerade obfuscated powershell repaired wscript zero-day

Link:

https://www.filescan.io/uploads/6a51ec6c37079e6cd576a86b/reports/da51ad1f-1993-4b96-aa26-837d89571a11/overview

Hybrid Analysis VBS/Agent.UDG trojan

Verdict:

Suspicious

Labled as:

VBS/Agent.UDG trojan

Link:

https://www.hybrid-analysis.com/sample/d92f3155a058d19c81eba292df6fa7d5080c684ba6a19d3d04d2bdd24796d53c

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-07-10T08:56:00Z UTC

Last seen:

2026-07-11T03:43:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/d92f3155a058d19c81eba292df6fa7d5080c684ba6a19d3d04d2bdd24796d53c/results?tab=lookup

Joe Sandbox Remcos

Result

Threat name:

Remcos

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1940902

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Creates an undocumented autostart registry key

Detected Remcos RAT

Found hidden mapped module (file has been removed from disk)

Found malware configuration

Installs a global keyboard hook

Joe Sandbox ML detected suspicious sample

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Powershell drops PE file

Sigma detected: Remcos

Sigma detected: Suspicious Parent Double Extension File Execution

Sigma detected: Windows Binaries Write Suspicious Extensions

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

WScript reads language and country specific registry keys (likely country aware script)

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

98%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/d92f3155a058d19c81eba292df6fa7d5080c684ba6a19d3d04d2bdd24796d53c

Malva.RE

Gathering data

CERT.PL MWDB remcos

Detection:

remcos

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/d92f3155a058d19c81eba292df6fa7d5080c684ba6a19d3d04d2bdd24796d53c/

Neiki Family.REMCOSRAT

Verdict:

Malicious

Threat:

Family.REMCOSRAT

Link:

https://tip.neiki.dev/file/d92f3155a058d19c81eba292df6fa7d5080c684ba6a19d3d04d2bdd24796d53c

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3extcvnaldizzaplukjn635h2ueay2clu2qz2pie2k65er4w2u6a._file

Threatray remcos

Verdict:

malicious

Label(s):

remcos

Alert

Create hunting rule

Similar samples:

11c9e5f53f0f64c9633bb1a2179ffc990651b31b52c18a212f05c2efc3824404

RemcosRAT

45ac1fc892511ba07ae315e448157446a27596bb81b0cb3b3b86720f7aee8adb

RemcosRAT

5489a805b1e17f8c133f9947aa6b317524c7ee5a341bd3f2aee85b3a111f8f6a

RemcosRAT

5b88eb2c33e9389324abd2f14064a0c1861bdccd5ee12c49e6620112c2c8dfaf

RemcosRAT

7c055f06c245ba0cc6afd6f7d0edf0dbc7934e53424c92e4174519726559dcec

RemcosRAT

b6b53447639ba3cabf6a16e27263c58ede0bef19706e2753bad2500d4f882678

RemcosRAT

df7f480c5a771425c1725f58524451d09439ba68934b63e09662e6dc2936b0af

RemcosRAT

error

RemcosRAT

+ 31 additional samples on MalwareBazaar

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos botnet:remotehost defense_evasion execution persistence rat

Link:

https://tria.ge/reports/260711-hypc4sfw8s/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Suspicious use of SetThreadContext

Hide Artifacts: Hidden Window

Checks computer location settings

Registers new Windows logon scripts automatically executed at logon.

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Family: Remcos

Malware Config

C2 Extraction:

79.141.165.55:2404

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d92f3155a058d19c81eba292df6fa7d5080c684ba6a19d3d04d2bdd24796d53c