MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e8278d3b9ff9e63c82acee904b0b49ae7b730430df757cc4739416fbe1f6a9af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 18

Intelligence 18 IOCs YARA 9 File information Comments

SHA256 hash:	e8278d3b9ff9e63c82acee904b0b49ae7b730430df757cc4739416fbe1f6a9af
SHA3-384 hash:	11f043f2b84c1757cdee6138661bdb947dde3c4706f5ec0528e33e162ec066288b923411411a788f72e0a8045865ac34
SHA1 hash:	9cc4bb700347b163521bd9f0e7352cdd6292c5be
MD5 hash:	9232e2b432e4089ae6ee21ee6326c1d4
humanhash:	sierra-winter-cup-bulldog
File name:	e8278d3b9ff9e63c82acee904b0b49ae7b730430df757cc4739416fbe1f6a9af
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	1'403'912 bytes
First seen:	2025-08-12 14:54:49 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep	24576:rJd5+504VVVsVDtzlFkujnFnv1MgP2I9Zbh96rnYPkrs9DLetKfxeWt:rJd57xtzlFfjlvJn9ZqSkA9PekMWt
Threatray	1'299 similar samples on MalwareBazaar
TLSH	T13B556AE291A508A5D4B35DB08812E8333256AC9AD82385198ED7FF5BF5F3ED30C23957
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
dhash icon	8e8f0f0f964d4d2c (4 x Formbook, 3 x AgentTesla, 3 x SnakeKeylogger)
Reporter	adrian__luca
Tags:	exe RemcosRAT

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

remcos

ID:

File name:

_e8278d3b9ff9e63c82acee904b0b49ae7b730430df757cc4739416fbe1f6a9af.exe

Verdict:

Malicious activity

Analysis date:

2025-08-12 21:27:24 UTC

Tags:

remcos rat auto-reg auto-sch-xml

Link:

https://app.any.run/tasks/2c7fe851-7ede-4d27-9bd4-98e0d151e51e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Remcos

Link:

https://www.capesandbox.com/analysis/20865/

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=689b59fbfca70bd90e8f1e49

Tags:

virus micro msil

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Сreating synchronization primitives

Searching for synchronization primitives

Sending a custom TCP request

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Adding an access-denied ACE

Creating a process with a hidden window

Creating a file in the %temp% directory

Launching a process

Restart of the analyzed sample

Creating a file

Creating a process from a recently created file

Unauthorized injection to a recently created process

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Adding an exclusion to Microsoft Defender

Enabling autorun by creating a file

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

invalid-signature obfuscated packed packed packer_detected signed

Link:

https://www.filescan.io/uploads/689b73949ef4d2ff7cf8d065/reports/32159ff9-2f32-435c-9837-7ce28dfb4823/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/e8278d3b9ff9e63c82acee904b0b49ae7b730430df757cc4739416fbe1f6a9af

Malware family:

REMCOS

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/dc76552f-98b0-4f09-becb-076b913b9fbc

Score:

98%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/e8278d3b9ff9e63c82acee904b0b49ae7b730430df757cc4739416fbe1f6a9af

Gathering data

Verdict:

Malicious

Threat:

Family.REMCOS

Link:

https://tip.neiki.dev/file/e8278d3b9ff9e63c82acee904b0b49ae7b730430df757cc4739416fbe1f6a9af

Threat name:

Win32.Trojan.DarkCloud

Status:

Malicious

First seen:

2025-07-30 06:26:49 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

27 of 38 (71.05%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5aty2o477htdzavm52iewc2jvz5xgbbq352xzrdtsqlpxypwvgxq._file

Verdict:

malicious

Label(s):

unc_loader_037

remcos

RemcosRAT

624f8c5eeb9c53aff00a43be9aeea85a0cb91eec236833e8c19424e70c1b5ddb

RemcosRAT

b792318331c4178ab12eba584e625fc6ec9ba6a69adfccd7f78b4b6380494593

RemcosRAT

c9670ae9c8ffd10a62ca47f243fce2e58357e65538fee6ea9b7c9ca82ded5ef3

RemcosRAT

error

RemcosRAT

f75c114f83d3d078bd85e7e59cd8a4ed6e8be4a33db6600bd9eda842845ac2fe

RemcosRAT

+ 1'289 additional samples on MalwareBazaar

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos discovery execution persistence rat

Link:

https://tria.ge/reports/250812-vgll4sspv8/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Adds Run key to start application

Checks computer location settings

Executes dropped EXE

Command and Scripting Interpreter: PowerShell

Remcos

Remcos family

Malware Config

C2 Extraction:

172.94.96.90:5999

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/b824367b-fc53-451e-a0ba-bc8f0044f164

Unpacked files

SH256 hash:

e8278d3b9ff9e63c82acee904b0b49ae7b730430df757cc4739416fbe1f6a9af

MD5 hash:

9232e2b432e4089ae6ee21ee6326c1d4

SHA1 hash:

9cc4bb700347b163521bd9f0e7352cdd6292c5be

Link:

https://www.unpac.me/results/39383ff6-0b2c-4276-bb31-486b6197a406/

SH256 hash:

6cafef187c07442d7beaddbfcc9fe4982b2a7ba1bed18612d3f082813487834c

MD5 hash:

78793128bd8a6a1345aac44b25a4d168

SHA1 hash:

519c3affb5ab7372e9bcdca1b8552b9ad61b2d9a

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/39383ff6-0b2c-4276-bb31-486b6197a406/

SH256 hash:

416e08f1041cab9cb51a436fa45160f70ab73e5e24adeaa743faffc1f30e23c2

MD5 hash:

df7d2354e3c992cda79997bf15b8cf73

SHA1 hash:

5726f7ea619b9279aa17fffc8b7a25c244e45b70

Detections:

win_remcos_w0

win_remcos_auto

Remcos

malware_windows_remcos_rat

win_remcos_rat_unpacked

INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Link:

https://www.unpac.me/results/39383ff6-0b2c-4276-bb31-486b6197a406/

Parent samples :

60682c9e70f15ee5e31dc5c054417386098c475be469994ea54b5c56847d4aaf
6400bf9fe56615568b8bd3ec6967fb72393b9df9a6bba89860ca95d8102afbf8
c7e099c60f551279ad41d2f35a001e14082346f15e312560771dac7302964da9
179fe62017bb17cf9b0ecaf118ec8a3bb14b351b448e6df3c029f29bf4385103
6fd471d3b5a60eb2827287c5b805a12d8e4147c5c2ce85585b3e2748a10e6226
f75c114f83d3d078bd85e7e59cd8a4ed6e8be4a33db6600bd9eda842845ac2fe
e8278d3b9ff9e63c82acee904b0b49ae7b730430df757cc4739416fbe1f6a9af
b32da4c31255e2f5dcf961e35e1757aca22f0c39cf80b3fac1d2a8aa734ae167

SH256 hash:

6005f0e4563fef5e8abfdb88cacd5b3d8fd4cff04b1af93e8e01a9990f46d5c0

MD5 hash:

3f17ed370489371093c2a3d768cb6b07

SHA1 hash:

fb4f0ddcaf872e4c7850e4cefad59a2c62f54424

Link:

https://www.unpac.me/results/39383ff6-0b2c-4276-bb31-486b6197a406/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e8278d3b9ff9e63c82acee904b0b49ae7b730430df757cc4739416fbe1f6a9af

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BlackGuard_Rule Create hunting rule
Author:	Jiho Kim
Description:	Yara rule for BlackGuarad Stealer v1.0 - v3.0
Reference:	https://www.virustotal.com/gui/file/67843d45ba538eca29c63c3259d697f7e2ba84a3da941295b9207cdb01c85b71/detection

Rule name:	INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438 Create hunting rule
Author:	ditekSHen
Description:	Detects executables signed with stolen, revoked or invalid certificates

Rule name:	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing bas64 encoded gzip files

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/20865/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample