MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f6d422f45cfdde668b5e7229844ff8a907ad97cc218ca45dff0747f3a79f871d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	f6d422f45cfdde668b5e7229844ff8a907ad97cc218ca45dff0747f3a79f871d
SHA3-384 hash:	cc8b3104acf4cefd96da029cdffa8d1f198b8817acb059ff3fab66695653de54c06e74252a9f5d31b3ffc9c8d53f036c
SHA1 hash:	3446f3bd07cd739dd5f01cf236c01283acbd8992
MD5 hash:	834cef755c9541a95ddba2a5927d1bcc
humanhash:	victor-berlin-orange-video
File name:	DHL RPA GRBP Template.PDF.gz
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	2'421 bytes
First seen:	2025-02-19 02:47:03 UTC
Last seen:	Never
File type:	gz
MIME type:	application/gzip
ssdeep	48:X/7x9Exq7bFzGBLfOdu3Apj0Jx+R0Ntj1wXhe+A1rRiGTB1Uw3Rk:zxuC5zofOdVp1RR9GTBhBk
TLSH	T1E44108CE15C874800853DE9DDEA56345907F3FC87AA348CB062A3F7B7BE5484C88267A
Magika	gzip
Reporter	MAM
Tags:	DHL gz RemcosRAT

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	DHL RPA GRBP Template.PDF.js
File size:	86'846 bytes
SHA256 hash:	abc914c82dac8f803df0ae50a350c38cd7af60344f60936a6df01198efbb03f6
MD5 hash:	27cb47b5e1ac316a34e346dc787782f6
MIME type:	text/plain
Signature	RemcosRAT

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.PUA.JS.Downloader-133.UNOFFICIAL

Sanesecurity.Foxhole.GZip_js.UNOFFICIAL

Verdict:

Malicious

Score:

94.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67b5477028ab76d43a5bb80b

Tags:

virus spawn

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

masquerade obfuscated

Link:

https://www.filescan.io/uploads/67b54635991985e0a95bc0a4/reports/01b6cfa2-7057-4281-ab7f-542a0da5b619/overview

Verdict:

Suspicious

Labled as:

Trojan.U.Remcos

Link:

https://www.hybrid-analysis.com/sample/f6d422f45cfdde668b5e7229844ff8a907ad97cc218ca45dff0747f3a79f871d

Result

Verdict:

UNKNOWN

Score:

100%

Verdict:

Malware

File Type:

Result

Malware family:

n/a

Score:

10/10

Tags:

execution

Link:

https://tria.ge/reports/250219-gbthwazqs4/

Behaviour

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Blocklisted process makes network request

Malware Config

Dropper Extraction:

https://3005.filemail.com/api/file/get?filekey=nIx_5T0LxHOBjilNb9CRviabPjrW2dlC-LxeOdJPF_Z_1MP6CuQBS5KcptA&pk_vid=342803d1cc4e3b801739359203b5fe9d

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f6d422f45cfdde668b5e7229844ff8a907ad97cc218ca45dff0747f3a79f871d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)