MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f453deac5a5df721aa4bca607e25a198cd4df29beb746bd4fdd4d4c4d09ea954. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f453deac5a5df721aa4bca607e25a198cd4df29beb746bd4fdd4d4c4d09ea954
SHA3-384 hash:	e4de4b5da4192039f9f03b0641e3ccb007976a083728cbdc5067da1c5fad36e9aba3ea3ebc958ea0de9fed2e2270f37f
SHA1 hash:	e0cc85e37a04f97ad93013cd8765b355de636ac3
MD5 hash:	d1078708b94c7acd3c45bf88ce812ba8
humanhash:	alpha-cold-sixteen-mike
File name:	garbage.bat
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	6'321 bytes
First seen:	2025-05-20 10:35:34 UTC
Last seen:	2025-06-22 17:13:22 UTC
File type:	bat
MIME type:	text/plain
ssdeep	192:t+jDEctBfOz0blQVjcNOnqDI204/V6tCy8K34FX9:QHJXb+gi4/MtCyj4D
TLSH	T106D13B56DC8044A1486F21AD2CC26017257ACEF8CC5ADCD7E9CE6C0B71EB74B60E75EA
Magika	powershell
Reporter	StefanKelm
Tags:	bat remcos RemcosRAT

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

171

Origin country :

DE

Vendor Threat Intelligence

ANY.RUN Suspicious

Malware family:

n/a

ID:

1

File name:

garbage.bat

Verdict:

Suspicious activity

Analysis date:

2025-05-20 10:24:40 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/aa9069e5-11c4-4757-8591-782c8d5d4980

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

ClamAV Detected

Detection(s):

SecuriteInfo.com.HEUR.Trojan.PowerShell.Obfus.gen.28879.2494.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

95.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=682c5b23c28c67d666424843

Tags:

vmdetect

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 obfuscated powershell

Link:

https://www.filescan.io/uploads/682c5b17c609634bd7cb3981/reports/ed0c9cc3-bfa0-4d0a-8fde-37e797212d79/overview

Hybrid Analysis BAT/Agent.ATL7.gen

Verdict:

Suspicious

Labled as:

BAT/Agent.ATL7.gen

Link:

https://www.hybrid-analysis.com/sample/f453deac5a5df721aa4bca607e25a198cd4df29beb746bd4fdd4d4c4d09ea954

Joe Sandbox GuLoader

Result

Threat name:

GuLoader

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1694840

Signature

Found suspicious powershell code related to unpacking or dynamic code loading

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Suspicious powershell command line found

Yara detected GuLoader

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/f453deac5a5df721aa4bca607e25a198cd4df29beb746bd4fdd4d4c4d09ea954

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f453deac5a5df721aa4bca607e25a198cd4df29beb746bd4fdd4d4c4d09ea954/

Neiki Malicious

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/f453deac5a5df721aa4bca607e25a198cd4df29beb746bd4fdd4d4c4d09ea954

ReversingLabs TitaniumCloud Script-PowerShell.Trojan.GuLoader

Threat name:

Script-PowerShell.Trojan.GuLoader

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-05-20 09:33:43 UTC

File Type:

Text

AV detection:

10 of 23 (43.48%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6rj55lc2lx3sdkslzjqh4jnbtdgu34u35n2gxvh52tkmjue6vfka._file

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos botnet:remotehost collection defense_evasion discovery execution rat trojan

Link:

https://tria.ge/reports/250520-mm7sjabm4y/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses Microsoft Outlook accounts

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Detected Nirsoft tools

NirSoft MailPassView

NirSoft WebBrowserPassView

Remcos

Remcos family

UAC bypass

Malware Config

C2 Extraction:

pcubed.duckdns.org:51024
pcircle.duckdns.org:64476

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f453deac5a5df721aa4bca607e25a198cd4df29beb746bd4fdd4d4c4d09ea954