MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ecd6819d5dbfda11e65380a6fc01db1714ccb8d8ab271c18e3ecd6eed04722b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ecd6819d5dbfda11e65380a6fc01db1714ccb8d8ab271c18e3ecd6eed04722b4
SHA3-384 hash: e74ca835299f2c18853648014e99e1d97c38caa6d47deb3b832df082449d0e9480c1f6abfca5eab7447743e880a1eb4a
SHA1 hash: ce3e74e2fa9d348eb4c641f38a5fdae5cdac3c0d
MD5 hash: 9c5cee77c6d01ac73103a327535318b9
humanhash: avocado-ohio-december-early
File name:pagamento1PDF.LNK
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:202'517 bytes
First seen:2025-06-04 07:02:07 UTC
Last seen:Never
File type:Shortcut (lnk) lnk
MIME type:application/x-ms-shortcut
ssdeep 6144:dYb55UZD00YHwlzBhrfn57IogfFRpY76EB:dYb55UZznfyS7h
Threatray 1'048 similar samples on MalwareBazaar
TLSH T1C714F161D7D51BCDFC380DBD48BA7A4D499D5D323C22C4F2D29B114B8134BEA6AA1C2B
Magika lnk
Reporter abuse_ch
Tags:lnk RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
NL NL
Vendor Threat Intelligence
Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=683ff0128bd5d68a12e4e596
Tags:
autorun delphi emotet cobalt
Result
Verdict:
Malicious
File Type:
LNK File - Malicious
Link:
https://app.docguard.net/ecd6819d5dbfda11e65380a6fc01db1714ccb8d8ab271c18e3ecd6eed04722b4/results/dashboard
Payload URLs
URL
File name
https://siraco.net/checka22.dat','C:\\ProgramData\\HEW.GIF');
LNK File
Behaviour
BlacklistAPI detected
Verdict:
Malicious
Labled as:
PWSH.Downloader.D.Generic
Link:
https://www.hybrid-analysis.com/sample/ecd6819d5dbfda11e65380a6fc01db1714ccb8d8ab271c18e3ecd6eed04722b4
Result
Threat name:
Remcos, DBatLoader
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1705616
Signature
Allocates many large memory junks
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Detected Remcos RAT
Drops PE files with a suspicious file extension
Early bird code injection technique detected
Encrypted powershell cmdline option found
Found malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Powershell drops PE file
Queues an APC in another process (thread injection)
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: PowerShell DownloadFile
Sigma detected: Remcos
Sigma detected: Suspicious PowerShell Download and Execute Pattern
Suspicious powershell command line found
Tries to download and execute files (via powershell)
Uses schtasks.exe or at.exe to add and modify task schedules
Windows shortcut file (LNK) contains suspicious command line arguments
Windows shortcut file (LNK) starts blacklisted processes
Yara detected DBatLoader
Yara detected Powershell download and execute
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1705616 Sample: pagamento1PDF.LNK.lnk Startdate: 04/06/2025 Architecture: WINDOWS Score: 100 40 siraco.net 2->40 58 Found malware configuration 2->58 60 Malicious sample detected (through community Yara rule) 2->60 62 Windows shortcut file (LNK) starts blacklisted processes 2->62 64 16 other signatures 2->64 9 powershell.exe 14 22 2->9         started        14 rundll32.exe 3 2->14         started        signatures3 process4 dnsIp5 44 siraco.net 217.172.98.96, 443, 49687 PARSCYBERIAN-ASIR Iran (ISLAMIC Republic Of) 9->44 38 C:\ProgramData\CHROME.PIF, PE32 9->38 dropped 76 Drops PE files with a suspicious file extension 9->76 78 Found suspicious powershell code related to unpacking or dynamic code loading 9->78 80 Powershell drops PE file 9->80 16 CHROME.PIF 3 9->16         started        20 conhost.exe 1 9->20         started        22 Dkwqmxap.PIF 14->22         started        file6 signatures7 process8 file9 36 C:\Users\user\Links\Dkwqmxap.PIF, PE32 16->36 dropped 46 Windows shortcut file (LNK) starts blacklisted processes 16->46 48 Early bird code injection technique detected 16->48 50 Drops PE files with a suspicious file extension 16->50 56 2 other signatures 16->56 24 SndVol.exe 4 16->24         started        28 cmd.exe 1 16->28         started        52 Allocates memory in foreign processes 22->52 54 Allocates many large memory junks 22->54 30 SndVol.exe 22->30         started        signatures10 process11 dnsIp12 42 198.23.227.212, 32583, 49692, 49693 AS-COLOCROSSINGUS United States 24->42 66 Uses schtasks.exe or at.exe to add and modify task schedules 28->66 32 conhost.exe 28->32         started        34 schtasks.exe 1 28->34         started        68 Contains functionality to bypass UAC (CMSTPLUA) 30->68 70 Detected Remcos RAT 30->70 72 Contains functionalty to change the wallpaper 30->72 74 3 other signatures 30->74 signatures13 process14
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ecd6819d5dbfda11e65380a6fc01db1714ccb8d8ab271c18e3ecd6eed04722b4/
Threat name:
Script-PowerShell.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2025-06-04 06:28:58 UTC
File Type:
Binary
Extracted files:
1
AV detection:
18 of 38 (47.37%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5tlidhk5x7nbdzstqctpyao3c4kmzogyvmtryghd5tlo5uchek2a._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
dbatloader
Create hunting rule
Similar samples:
2567bb2ba292ab96811afc9a327e2e5cdccbc021c3d4aad732a5703c0b4dfd07
RemcosRAT
27556cd8c9966eb45852c7a5086899716580db76fd82a7ec828915280466c317
RemcosRAT
4cb3ef2e578fdd542b80162fb0141662b7fd1d6b808bcad220c004fe61e3836c
RemcosRAT
66bc91399d2182893517c0d7aecdcabb23925c6b01ee0bd73c957ac4a2b46760
RemcosRAT
936e5340ad0a95ee79e17b489f85c661bcd73b5000c5d02c65e6ddba2943a2cd
RemcosRAT
9f146cf7dbef2543742cf970ce79bf792211b2ffec0426600bab4e556874125b
RemcosRAT
c20219dd7ad8a241adb5a654604a74ad081197646ae3fa373ea54f40bebd9874
RemcosRAT
c8bb23fb898f54fdc987c85a92aa1786c4c376ca40f11a4be496cc67bad8c8a7
RemcosRAT
error
RemcosRAT
ffb943262bdb8e7f1ffca4b0cf042d571544e845f2d2fbaa7560d0ee74271fda
RemcosRAT
+ 1'038 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery execution
Link:
https://tria.ge/reports/250604-htyqzshq8t/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Checks computer location settings
Executes dropped EXE
Blocklisted process makes network request
Command and Scripting Interpreter: PowerShell
Malware Config
Dropper Extraction:
https://siraco.net/checka22.dat
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ecd6819d5dbf/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ecd6819d5dbfda11e65380a6fc01db1714ccb8d8ab271c18e3ecd6eed04722b4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Archive_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies archive (compressed) files in shortcut (LNK) files.
Rule name:Download_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies download artefacts in shortcut (LNK) files.
Rule name:Large_filesize_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies shortcut (LNK) file larger than 100KB. Most goodware LNK files are smaller than 100KB.
Rule name:PS_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies PowerShell artefacts in shortcut (LNK) files.
Rule name:SUSP_LNK_SuspiciousCommands
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects LNK file with suspicious content
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments