MB-5d8b365ca864c693f967e2b087db0838dea3cb639325ae9be1df085b771f8796
high
📛 Threat Title
RemcosRAT: Order Specicifications-request for AYB64537.J.js
Description
File type: js. Size: 4366858 bytes. Tags: js, RAT, RemcosRAT. Reporter: abuse_ch. First seen: 2026-08-04 21:45:14.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
5d8b365ca864c693f967e2b087db0838dea3cb639325ae9be1df085b771f8796
IOC database
- Type
- hash_sha256
- Value
5d8b365ca864c693f967e2b087db0838dea3cb639325ae9be1df085b771f8796- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- RemcosRAT
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
d5b0fe65a71d1493c87bb3205a55504209868b9a
IOC database
- Type
- hash_sha1
- Value
d5b0fe65a71d1493c87bb3205a55504209868b9a- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
fa401024b25cfc7e0a62134ff7ff71e3
IOC database
- Type
- hash_md5
- Value
fa401024b25cfc7e0a62134ff7ff71e3- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: js. Size: 4366858 bytes. Tags: js, RAT, RemcosRAT. Reporter: abuse_ch. First seen: 2026-08-04 21:45:14.
Remediations (10)
-
web:blog.netmanageit.com
Description Remcos is a sophisticated RAT which provides an attacker with backdoor access to the infected system and collects a variety of sensitive information. Remcos incorporates different obfuscation and anti-debugging techniques to evade detection. It regularly updates its features and makes this malware a challenging adversary.
-
web:cybersecuritynews.com
Researchers at Trustwave SpiderLabs has uncovered a sophisticated malspam campaign distributing the notorious RemcosRAT malware on windows. The campaign leverages a deceptive fake payment notice disguised as a SWIFT copy to trick victims into downloading a malicious PDF, ultimately leading to the deployment of the remote access trojan (RAT).
-
web:github.com
#Remcos RAT Incident Analysis & Indicators of Compromise (IoCs) This repository details the findings from a recent incident response engagement involving a Remcos Remote Access Trojan (RAT) infection. My analysis focused on network traffic captured in a Packet Capture (PCAP) file to identify the malware's communication patterns, Command & Control (C2) infrastructure, and exfiltration ...
-
web:learn.microsoft.com
Remediate security weaknesses discovered through security recommendations, and create exceptions if needed, in Defender Vulnerability Management.
-
web:socprime.com
A purchase- order phishing lure uses VBS and hidden PowerShell to load a fake PNG payload and deploy Remcos RAT in memory
-
web:www.aryaka.com
Explore how Remcos RAT evades detection, leverages PowerShell loaders, and establishes encrypted C2 channels for data exfiltration. Learn how Aryaka Unified SASE detects and blocks Remcos threats with deep network visibility and Zero Trust controls.
-
web:www.csk.gov.in
It is reported that a malware dubbed as Remcos RAT (Remote Control and Surveillance Trojan) which is a sophisticated Remote Access Trojan (RAT), is being escalated by the threat actors for espionage, credential theft, and system takeover. Remcos (Remote Control and Surveillance) is a Remote Access Trojan (RAT) created by Breaking Security and initially promoted as a legitimate tool for remote ...
-
web:www.fortinet.com
See how threat actors have abused Remcos to collect sensitive information from victims and remotely control their computers to perform further malicious acts.
-
web:www.hornetsecurity.com
This article walks you through the full attack chain, the payload recovery process, and the evidence linking the final stage to Remcos RAT.
-
web:www.mcafee.com
RemcosRat is a complex multi-stage threat. McAfee Labs unpacked the how this malware downloads and executes VBS and PowerShell scripts; how the threat unwraps different layers and downloads the final Remcos remote access payload.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.