MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e52f6947edde744fdc17c3e717af9534d6251ff1baee0f86c3f0c7beac636a8b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 8


Intelligence 8 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e52f6947edde744fdc17c3e717af9534d6251ff1baee0f86c3f0c7beac636a8b
SHA3-384 hash: 772c290619869c9f4ae80b4352ec372cf6b38a3e2f175f7eaed8561eea6cebbe04051c132915d6c47c12f1e8a69b47cf
SHA1 hash: 802879e6ffd00845553150a12eedd31e3b4dc465
MD5 hash: 32566817f7ecb3e56eb134b24715c0b7
humanhash: vermont-winner-saturn-indigo
File name:PO MF25020377.zip
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:1'182'451 bytes
First seen:2025-09-08 15:26:23 UTC
Last seen:2025-09-08 15:53:59 UTC
File type: zip
MIME type:application/zip
ssdeep 24576:1GiI8hAe73yQDlakIq85/wAwL5rYvNab8kT29nTdVoJr+1O/KjxbafoUSH:1Gj8hAWyQDIjq5r+Nab129TPogO/Kxue
TLSH T17B4533CD80E97843E58C51B5B81D2C6A8F25B866BF2F61A4FB7082D9EB74C788731705
Magika zip
Reporter cocaman
Tags:RemcosRAT zip


Avatar
cocaman
Malicious email (T1566.001)
From: ""Ashley Lee" <info@ogvkeqz.co>" (likely spoofed)
Received: "from ogvkeqz.co (unknown [31.7.58.222]) "
Date: "7 Sep 2025 17:50:57 -0700"
Subject: "New order 07-Sept-2025"
Attachment: "PO MF25020377.zip"

Intelligence

File Origin
# of uploads :
2
# of downloads :
67
Origin country :
CH CH
File Archive Information

This file archive contains 13 file(s), sorted by their relevance:

File name:core.xml
File size:648 bytes
SHA256 hash: 5118c783cb7f5b7f33faced82cfeb9d9442bdeae2c04af40d5dbe92df2888e76
MD5 hash: 6ecf6e799e4d99fd0366ecdf08f77ca3
MIME type:text/xml
Signature RemcosRAT
File name:settings.xml
File size:3'002 bytes
SHA256 hash: 62a6add989df8eda6dac0d2b7f9f10129f2d6947cb749ea7ab181a801e9a9c4f
MD5 hash: 849ef7fca954ce2d68e6a37f61bfbce3
MIME type:text/xml
Signature RemcosRAT
File name:[Content_Types].xml
File size:1'487 bytes
SHA256 hash: cc8e527c51b340385555f7e8e5bf31fcb6cc5bf86d0e60f3beaad91486c59ec5
MD5 hash: 0acdcf99917008b8ccf2520530ef775e
MIME type:text/xml
Signature RemcosRAT
File name:document.xml
File size:171'458 bytes
SHA256 hash: 48946b4e4bd548556de8d04430efdeb067fca2b3aecbee783053a629a5dfd992
MD5 hash: 1540bbe6186fe76709261e28c38168dd
MIME type:text/xml
Signature RemcosRAT
File name:custom.xml
File size:797 bytes
SHA256 hash: fe478f111993de8d677bb79611cccc35c6b6dc522b063de7d9e7c7c402ac1857
MD5 hash: 51dd3871fc18210d45988fd335bdf146
MIME type:text/xml
Signature RemcosRAT
File name:webSettings.xml
File size:1'060 bytes
SHA256 hash: 246ca94e5cbe02df81802f83f143f829966fdef93bc242fa568e1de2497ecdea
MD5 hash: 5e9299fe05864057a56033c6bb91a9a8
MIME type:text/xml
Signature RemcosRAT
File name:app.xml
File size:714 bytes
SHA256 hash: 85a7a158477afa0b6f378054c3b07ec8bb542c6b63deb8372af6638a6d06a4e0
MD5 hash: ed6a0464998eb27450e5fbd6ab0e4400
MIME type:text/xml
Signature RemcosRAT
File name:theme1.xml
File size:6'992 bytes
SHA256 hash: bf4992e3fa7832e5c68fdbc4ec5189c8e5d347fef03c5ba2522ad704bde5078f
MD5 hash: 9d84374caf9c73ec77677afd23cb7b22
MIME type:text/xml
Signature RemcosRAT
File name:document.xml.rels
File size:1'081 bytes
SHA256 hash: ffdc778961f6bbd2567666b5de8e12df4576a4b5c9a8102b04a5f6b6c00e1b23
MD5 hash: 4298085cbffec499c9846c936441a30f
MIME type:text/xml
Signature RemcosRAT
File name:fontTable.xml
File size:2'529 bytes
SHA256 hash: dcb6dfa29a5cf106c3c58624a77c1b99cda0f894c1b08f6f8201db0c82b6069e
MD5 hash: 1f1bbf7cd8f4eba6343a52d04f3fbfc4
MIME type:text/xml
Signature RemcosRAT
File name:image2.png
File size:19'061 bytes
SHA256 hash: 8c66db1e63d23baa002b642bd44e90cde574770d2641ca23b83fcdaf0d3d3d3d
MD5 hash: d8f99da0edc544b58913b69d50527cda
MIME type:image/png
Signature RemcosRAT
File name:240153-MTCO-Purchase Note.scr.scr
File size:1'345'536 bytes
SHA256 hash: e2a70b214b0d1f0a2f22955d257fa2189e1c9108987248ec44a30b2fe717a386
MD5 hash: 72e58f40797514c7580502ce1a03f42c
MIME type:application/x-dosexec
Signature RemcosRAT
File name:styles.xml
File size:30'396 bytes
SHA256 hash: 77d139eaa026dd75b31a8ab74766ce8b7ed81473ab4323575e07103a1680f88a
MD5 hash: c63930752b6e7d2ac421bfa84d2112e9
MIME type:text/xml
Signature RemcosRAT
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_scr.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PUA.EmbeddedEXE-1.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Zip.SCR-1.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68bef5b66e66ba602d792eb2
Tags:
n/a
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 bitmap evasive lolbin masquerade msbuild obfuscated packed packed packed rat rat reconnaissance regsvcs remcos remcos rezer0 roboski schtasks stego vbc windows
Link:
https://www.filescan.io/uploads/68bef5c1cfa59bfdc7f3b5bc/reports/6e73607c-40b7-4e0a-8a61-c4c1845c204d/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/e52f6947edde744fdc17c3e717af9534d6251ff1baee0f86c3f0c7beac636a8b
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/e52f6947edde744fdc17c3e717af9534d6251ff1baee0f86c3f0c7beac636a8b
Details
Document With Few Pages
Document contains between one and three pages of content. Most malicious documents are sparse in page count.
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
File Type:
zip
First seen:
2025-09-07T21:30:00Z UTC
Last seen:
2025-09-07T21:30:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/e52f6947edde744fdc17c3e717af9534d6251ff1baee0f86c3f0c7beac636a8b/results?tab=lookup
Score:
87%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/e52f6947edde744fdc17c3e717af9534d6251ff1baee0f86c3f0c7beac636a8b
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.43 Zip Archive
Link:
https://app.malva.re/file/32566817f7ecb3e56eb134b24715c0b7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e52f6947edde744fdc17c3e717af9534d6251ff1baee0f86c3f0c7beac636a8b/
Threat name:
Win64.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2025-09-08 13:45:21 UTC
File Type:
Binary (Archive)
Extracted files:
29
AV detection:
24 of 38 (63.16%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4uxwsr7n3z2e7xaxyptrpl4vgtlckh7rxlxa7bwd6dd35lddnkfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.20
Link:
https://yomi.yoroi.company/submissions/e52f6947edde744fdc17c3e717af9534d6251ff1baee0f86c3f0c7beac636a8b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:win32_dotnet_form_obfuscate
Create hunting rule
Author:Reedus0
Description:Rule for detecting .NET form obfuscate malware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

zip e52f6947edde744fdc17c3e717af9534d6251ff1baee0f86c3f0c7beac636a8b

(this sample)

RemcosRAT

Executable exe e2a70b214b0d1f0a2f22955d257fa2189e1c9108987248ec44a30b2fe717a386

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e2a70b214b0d1f0a2f22955d257fa2189e1c9108987248ec44a30b2fe717a386
  
Dropping
RemcosRAT
  
Dropping
SHA256 179e94db91298bdec3b9256b3f85634b6ca1df6057b2016e2e80e09aff58f51b
  
Dropping
MD5 72e58f40797514c7580502ce1a03f42c
  
Dropping
MD5 dc788affbc0f75670e6bc154d4ac0681

Comments