🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f993c4798c266775d3e50bfe9fe87fd8904b31e1a7d4d7af4aa4c84303d52adc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f993c4798c266775d3e50bfe9fe87fd8904b31e1a7d4d7af4aa4c84303d52adc
SHA3-384 hash: 06f35486a1228d39651d83d808a0f534256d2123ab11d431a46b780b16c538006c626eaba90e6329542628514460ae17
SHA1 hash: be0d7c7680af1a87559ddea664fbbb1c4aa116b3
MD5 hash: 75eff53d07af4c17e13d4abc9c075694
humanhash: kansas-beer-ack-finch
File name:TelegramFix2.msi
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:774'144 bytes
First seen:2026-04-23 17:34:08 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 12288:r6THK6reSAHNMDjysRYPb0VtYIxHNxBvihrSN/FvmBHCTYJTTR0MKn9oz0xXvQaq:r6THK6WtoPub0VtRvf9DGfyZnCQx5fN
Threatray 176 similar samples on MalwareBazaar
TLSH T169F423C23E005333C9D5127F113D69809AAA6C761A2795A2B65BF31C2A33BF553B39D8
TrID 86.8% (.MSI) Microsoft Windows Installer (454500/1/170)
11.6% (.MST) Windows SDK Setup Transform script (61000/1/5)
1.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter Alex_sev
Tags:backdoor msi remcos RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
174
Origin country :
AU AU
Vendor Threat Intelligence
Malware configuration found for:
MSI Remcos
Details
MSI
an embedded setup program or component
Remcos
a version number and verbose configuration settings
Link:
https://research.acce.ciphertechsolutions.com/results/1b451890-8199-4533-90f0-06314ee29b1e/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/63375/
Detection(s):
Win.Trojan.Remcos-10002580-0
Create hunting rule

YARA.EMBEERESEARCH_Win_Remcos_Rat_Unpacked.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69ea582c4aed15d0792fa6c7
Tags:
remcos virus spawn
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug CAB cmd config-extracted crypto exploit explorer fingerprint installer installer keylogger lolbin remcos rundll32 runonce zero-day
Link:
https://www.filescan.io/uploads/69ea5826594172aacc4c29d6/reports/78ff0f97-1c04-4a89-8934-963a8dc4cb14/overview
Verdict:
Suspicious
Labled as:
Malware.Generic
Link:
https://www.hybrid-analysis.com/sample/f993c4798c266775d3e50bfe9fe87fd8904b31e1a7d4d7af4aa4c84303d52adc
Verdict:
Malicious
File Type:
msi
First seen:
2026-04-21T05:50:00Z UTC
Last seen:
2026-04-24T20:41:00Z UTC
Hits:
~10
Detections:
Backdoor.Win32.Androm.sb Trojan.Win32.Agent.sb HEUR:Trojan.Win64.Generic HEUR:Trojan.Win64.EDRBypass.a HackTool.Win64.Knotweed.aex Backdoor.Win32.Zegost.sb Trojan-Dropper.Win32.Injector.sb PDM:Trojan.Win32.Generic
Link:
https://opentip.kaspersky.com/f993c4798c266775d3e50bfe9fe87fd8904b31e1a7d4d7af4aa4c84303d52adc/results?tab=lookup
Score:
100%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/f993c4798c266775d3e50bfe9fe87fd8904b31e1a7d4d7af4aa4c84303d52adc
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
CAB:COMPRESSION:MSZIP Executable Office Document PDB Path PE (Portable Executable) PE File Layout PE Memory-Mapped (Dump)
Link:
https://app.malva.re/file/75eff53d07af4c17e13d4abc9c075694
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f993c4798c266775d3e50bfe9fe87fd8904b31e1a7d4d7af4aa4c84303d52adc/
Verdict:
Malicious
Threat:
Family.REMCOS
Link:
https://tip.neiki.dev/file/f993c4798c266775d3e50bfe9fe87fd8904b31e1a7d4d7af4aa4c84303d52adc
Threat name:
Win64.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2026-04-23 17:34:37 UTC
File Type:
Binary (Archive)
Extracted files:
19
AV detection:
18 of 38 (47.37%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7gj4i6mmeztxlu7fbp7j72d73ciewmpbu7knpl2kuteega6vfloa._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
08e51e36a95e7aa0b388ccab1aa085836ed86b2ef8c0ccc21f10f700029e31a9
RemcosRAT
888025a04ff1cf4cda4b30aece9f183247670305729b61f2a2d766a7bf0d7fff
RemcosRAT
be94ed15a50a3386f6ab466401d68faf13ead40a05f50c37f410414b57512d3c
RemcosRAT
e29a9375ec13c8a7df64cdf4743fb77d4a3e651550269bf0942143adf42fa110
RemcosRAT
ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b
RemcosRAT
error
RemcosRAT
f993c4798c266775d3e50bfe9fe87fd8904b31e1a7d4d7af4aa4c84303d52adc
RemcosRAT
+ 166 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:mole adware defense_evasion execution persistence privilege_escalation ransomware rat spyware trojan
Link:
https://tria.ge/reports/260423-v5pcxacz5x/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Modifies Internet Explorer settings
Modifies data under HKEY_USERS
Modifies registry class
Modifies registry key
Scheduled Task/Job: Scheduled Task
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy service COM API
Enumerates physical storage devices
Event Triggered Execution: Installer Packages
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of SetThreadContext
Adds Run key to start application
Enumerates connected drives
Executes dropped EXE
Family: Remcos
UAC bypass
Malware Config
C2 Extraction:
149.50.96.57:443
149.50.96.57:80
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f993c4798c26/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f993c4798c266775d3e50bfe9fe87fd8904b31e1a7d4d7af4aa4c84303d52adc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/63375/

Comments