MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eba7cc03097f2a51ada7e787ee48c728b75cd20ff1fe8c5551df3d3eea0ed808. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	eba7cc03097f2a51ada7e787ee48c728b75cd20ff1fe8c5551df3d3eea0ed808
SHA3-384 hash:	493a0b6c63c91280200f9d0272c3935704798d2c01b5bd4360a26008b1f5745eefaa3472a9a1d8d7c734e98fd43f8030
SHA1 hash:	35d98a13b3fd0856a349dd54866016970ded0906
MD5 hash:	1819584d648d5b928117bc94c7773736
humanhash:	missouri-cat-timing-river
File name:	DOC20220513PRELIMINARC0559DOC030273211.JS
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	6'246'694 bytes
First seen:	2026-03-02 10:05:14 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	98304:W6hBfgfJNmWKTWV1ArS99elpBoY2SIgtC8fl+xE2cLTlLEKYzbYKUm5cSbIaFYJG:B81DKpZfl0Et7Y3xU8claGA
TLSH	T11856E7C0329099C32A3F1A74EA1D25C3AD4519F7E9F49B4A71863F97B198B01BF346B1
Magika	javascript
Reporter	abuse_ch
Tags:	js RemcosRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

390

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69a56136002d37d5c982a339

Tags:

autoit emotet

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug autoit dropper evasive expired-cert fingerprint keylogger obfuscated persistence repaired

Link:

https://www.filescan.io/uploads/69a560f49eaae846594165cc/reports/9bc66bbd-cc7f-4d38-8df6-241cb79e03fd/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/eba7cc03097f2a51ada7e787ee48c728b75cd20ff1fe8c5551df3d3eea0ed808

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

Detections:

PDM:Trojan.Win32.Generic Trojan.JS.SAgent.sb HEUR:Trojan-Dropper.Script.Generic HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/eba7cc03097f2a51ada7e787ee48c728b75cd20ff1fe8c5551df3d3eea0ed808/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/1876688

Signature

Multi AV Scanner detection for submitted file

Sigma detected: WScript or CScript Dropper

Behaviour

Behavior Graph:

Download SVG

Malva.RE

Gathering data

CERT.PL MWDB remcos

Detection:

remcos

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/eba7cc03097f2a51ada7e787ee48c728b75cd20ff1fe8c5551df3d3eea0ed808/

Neiki Family.REMCOS

Verdict:

Malicious

Threat:

Family.REMCOS

Link:

https://tip.neiki.dev/file/eba7cc03097f2a51ada7e787ee48c728b75cd20ff1fe8c5551df3d3eea0ed808

ReversingLabs TitaniumCloud Script-JS.Trojan.Generic

Threat name:

Script-JS.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-02-27 15:57:52 UTC

File Type:

Binary

AV detection:

6 of 24 (25.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5ot4yayjp4vfdlnh46d64sghfc3vzuqp6h7iyvkr346t52qo3aea._file

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:donutloader family:remcos botnet:remotehost discovery execution loader persistence rat

Link:

https://tria.ge/reports/260302-l4rbfah19a/

Behaviour

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Adds Run key to start application

Checks computer location settings

Executes dropped EXE

Detects DonutLoader

DonutLoader

Donutloader family

Remcos

Remcos family

Malware Config

C2 Extraction:

www.delmontoyalogisticsllc.com:2404
www.delmontoyalogisticsllc1.com:2404
www.delmontoyalogisticsllc2.com:2404

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/eba7cc03097f2a51ada7e787ee48c728b75cd20ff1fe8c5551df3d3eea0ed808