MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f177dcd7304d7287c4ee3ce1220e57515124a59f7f6f425bba6f2263a05bfed9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f177dcd7304d7287c4ee3ce1220e57515124a59f7f6f425bba6f2263a05bfed9
SHA3-384 hash:	a934a2a87e7083b8b5ccbb30f9390c77c2f270d8ca9d3107c0abd8262067f7d9a77f4254416001dfdee04e495549d517
SHA1 hash:	66635be19b12e8383a35dbd4a8d4cbb9de6e4f6b
MD5 hash:	400f39fc86f0b5eeff5cf5f0ec9b2939
humanhash:	angel-texas-fish-fix
File name:	ORDINE TM520505_051518A.pdf.JS
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	1'544'977 bytes
First seen:	2026-09-02 06:05:50 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	24576:JXMYrM/aRlg7R2JEN1YWFyga/6BiTAh3ldA:VVrzlg4GN1YWFybiAAh3ldA
TLSH	T18165F7AB18826EC90DEFE3DF464ADC0EE89D0E5A4802BF3E343F81D45F66655794885C
Magika	javascript
Reporter	lowmal3
Tags:	js RemcosRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

184

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

evasive obfuscated opendir repaired

Link:

https://www.filescan.io/uploads/6a97bcd2630fde3c95ffa6a5/reports/2225a4e6-5b36-4ca5-88f8-a26f885555c0/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/f177dcd7304d7287c4ee3ce1220e57515124a59f7f6f425bba6f2263a05bfed9

Kaspersky OpenTIP Unknown

Verdict:

Unknown

File Type:

Link:

https://opentip.kaspersky.com/f177dcd7304d7287c4ee3ce1220e57515124a59f7f6f425bba6f2263a05bfed9/results?tab=lookup

Joe Sandbox Remcos, DonutLoader

Result

Threat name:

Remcos, DonutLoader

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1967152

Signature

Attempt to bypass Chrome Application-Bound Encryption

Creates autostart registry keys with suspicious names

Detected Remcos RAT

JavaScript file contains Antivirus product strings

JavaScript file contains suspicious strings

JavaScript source code contains call to eval() to check own source code (likely for evading instrumentation)

JavaScript source code contains functionality to generate code involving a shell, file or stream

JavaScript source code contains functionality to generate code involving HTTP requests or file downloads

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Sigma detected: Potential Data Stealing Via Chromium Headless Debugging

Sigma detected: Remcos

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: Suspicious Parent Double Extension File Execution

Sigma detected: WScript or CScript Dropper

System process connects to network (likely due to code injection or exploit)

Tries to harvest and steal browser information (history, passwords, etc)

Unusual module load detection (module proxying)

Uses an obfuscated file name to hide its real file extension (double extension)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Yara detected DonutLoader

Behaviour

Behavior Graph:

Download SVG

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f177dcd7304d7287c4ee3ce1220e57515124a59f7f6f425bba6f2263a05bfed9/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6f35zvzqjvziprhohtqsedsxkfisjjm7p5xuew52n4rghic373mq._file

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:donutloader family:remcos botnet:remotehost credential_access discovery execution loader persistence ransomware rat stealer

Link:

https://tria.ge/reports/260902-gttllavbpa/

Behaviour

Modifies registry class

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Uses Volume Shadow Copy WMI provider

Uses Volume Shadow Copy service COM API

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

System Time Discovery

Adds Run key to start application

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Badlisted process makes network request

Uses browser remote debugging

Detects DonutLoader

Family: DonutLoader

Family: Remcos

Malware Config

C2 Extraction:

141.98.10.129:2404

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.38

Link:

https://yomi.yoroi.company/submissions/f177dcd7304d7287c4ee3ce1220e57515124a59f7f6f425bba6f2263a05bfed9