MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2ffb11a68f8c689d0df4b2f035be0d9d3aff4b3ad4c3a158741050c6948fcb7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f2ffb11a68f8c689d0df4b2f035be0d9d3aff4b3ad4c3a158741050c6948fcb7
SHA3-384 hash:	962f56421c93eda12331b326585721e1c35d43aa7af379ef2d3758d62a18046934ec29654797f880e77ed838a2c3b58d
SHA1 hash:	6cedc59f2b8b4276ecf06f0147612e0caec416dc
MD5 hash:	54b076a681eb063ad7eca17f66f633fa
humanhash:	lima-artist-william-orange
File name:	rCM6074148603R2795244242442424253535.bat
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	6'254 bytes
First seen:	2025-11-03 04:31:14 UTC
Last seen:	2026-05-20 18:25:58 UTC
File type:	bat
MIME type:	text/plain
ssdeep	96:YVZbXzLYwVb6dc1NWJ4/kI7qmTmNzHKS35lhyBEc8WCLBDkYRhB55wiYiFzxt5V:YVZ/LydGG4/35To3LhyB2WCxLhTKez/D
TLSH	T1D2D11969D7D69278288D929C671F4D47CABB82CD04A1497027FDCE339CC852D660D0FB
Magika	txt
Reporter	FXOLabs
Tags:	bat RemcosRAT

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

96

Origin country :

BR

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

ARAMEX AWB 6074148603 R2795244242442424253535.bat

Verdict:

Malicious activity

Analysis date:

2025-11-02 18:31:57 UTC

Tags:

ipfs phishing massbass

Link:

https://app.any.run/tasks/dc1f82c6-4e1f-44be-8850-1ca678130165

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/35046/

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69083027706befaf4ecb4b28

Tags:

xtreme shell sage

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

DNS request

Connection attempt

Sending a custom TCP request

Connecting to a non-recommended domain

Sending an HTTP GET request

Creating a file in the %AppData% directory

Using the Windows Management Instrumentation requests

Creating a process with a hidden window

Launching a process

Running batch commands

Possible injection to a system process

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Using obfuscated Powershell scripts

Unauthorized injection to a system process

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 obfuscated powershell powershell

Link:

https://www.filescan.io/uploads/69083024de25fddba0621acb/reports/ebdd06b0-c988-4db3-a9df-e1d38a02a3e2/overview

Hybrid Analysis BAT/Agent.BDZ1

Verdict:

Suspicious

Labled as:

BAT/Agent.BDZ1

Link:

https://www.hybrid-analysis.com/sample/f2ffb11a68f8c689d0df4b2f035be0d9d3aff4b3ad4c3a158741050c6948fcb7

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

ps1

First seen:

2025-11-02T08:00:00Z UTC

Last seen:

2025-11-05T02:34:00Z UTC

Hits:

~1000

Detections:

HEUR:Trojan.Script.Generic HEUR:Trojan.BAT.Obfuscated.gen

Link:

https://opentip.kaspersky.com/f2ffb11a68f8c689d0df4b2f035be0d9d3aff4b3ad4c3a158741050c6948fcb7/results?tab=lookup

Nucleon Malprob Malware

Score:

87%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/f2ffb11a68f8c689d0df4b2f035be0d9d3aff4b3ad4c3a158741050c6948fcb7

CERT.PL MWDB remcos

Detection:

remcos

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/f2ffb11a68f8c689d0df4b2f035be0d9d3aff4b3ad4c3a158741050c6948fcb7/

Neiki Trojan.BAT.Obfuscated

Verdict:

Malicious

Threat:

Trojan.BAT.Obfuscated

Link:

https://tip.neiki.dev/file/f2ffb11a68f8c689d0df4b2f035be0d9d3aff4b3ad4c3a158741050c6948fcb7

ReversingLabs TitaniumCloud Script-PowerShell.Trojan.GuLoader

Threat name:

Script-PowerShell.Trojan.GuLoader

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-11-02 10:59:56 UTC

File Type:

Text

AV detection:

11 of 38 (28.95%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6l73cgti7dditug7jmxqgw7a3hj275ftvvgdufmhiecqy2ki7s3q._file

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:guloader family:remcos botnet:bamboo collection defense_evasion discovery downloader execution persistence rat trojan

Link:

https://tria.ge/reports/251103-e5nhlsvqaw/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Drops file in System32 directory

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses Microsoft Outlook accounts

Adds Run key to start application

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Detected Nirsoft tools

NirSoft MailPassView

NirSoft WebBrowserPassView

Guloader family

Guloader,Cloudeye

Remcos

Remcos family

UAC bypass

Malware Config

C2 Extraction:

adigo.ydns.eu:60736
wormoni.lms-austria.com:52082

VMRay GuLoader

Malware family:

GuLoader

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/f2ffb11a68f8/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f2ffb11a68f8c689d0df4b2f035be0d9d3aff4b3ad4c3a158741050c6948fcb7

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

bat f2ffb11a68f8c689d0df4b2f035be0d9d3aff4b3ad4c3a158741050c6948fcb7

(this sample)

  

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/35046/