7f2a36c6e2ce7bded3e0e63d2275fb56e5236ee16e58b04c83123a2a79e5d34a

Classification: Malicious

7f2a36c6e2ce7bded3e0e63d2275fb56e5236ee16e58b04c83123a2a79e5d34a is a malicious file sample. Reported by 2 threat sources, last seen 2026-09-02.

Detection summary

  • 61 antivirus detections
  • 1 IDS alerts
  • 16 processes observed
  • 3 contacted hosts
  • 2 DNS requests

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic Malware Hybrid-Analysis 2024-10-16 17:15:06 2026-09-02 13:45:04 malicious-activity
RemcosRAT MalwareBazaar Abuse.ch 2024-10-16 16:48:07 2024-10-16 16:48:07 malicious-activity

Tags

windows-server-utility

Sample information

Filenames
7f2a36c6e2ce7bded3e0e63d2275fb56e5236ee16e58b04c83123a2a79e5d34a, 17290972859113f7995b23df55ec0b2b7ae16822e0e59b575d2cfb603e79ed2793266980db734.dat-decoded, 17290972859113f7995b23df55ec0b2b7ae16822e0e59b575d2cfb603e79ed2793266980db734.dat-decod
File type
PE32 executable (GUI) Intel 80386, for MS Windows
Size
494592 bytes
MD5
6055716727c9a3d33cedddff7ca35d87
SHA-1
2e5c3d0623cce8a2d9482078e0b0fd83af504dd2
SHA-256
7f2a36c6e2ce7bded3e0e63d2275fb56e5236ee16e58b04c83123a2a79e5d34a
First indexed
2024-10-16 16:49:16
Last updated
2026-09-02 13:45:04

Antivirus detections

EngineDetection
ALYacGeneric.Remcos.4254337F
APEXMalicious
AVGWin32:RATX-gen [Trj]
AhnLab-V3Backdoor/Win.Remcos.R634199
Antiy-AVLTrojan[Backdoor]/Win32.Rescoms.b
ArcabitGeneric.Remcos.D40EA81F
AvastWin32:RATX-gen [Trj]
AviraBDS/Backdoor.Gen
BaiduWin32.Trojan.Kryptik.awm
BitDefenderGeneric.Remcos.4254337F
BkavW32.AIDetectMalware
CTXexe.trojan.remcos
CrowdStrikewin/malicious_confidence_100% (D)
CylanceUnsafe
CynetMalicious (score: 100)
DeepInstinctMALICIOUS
DrWebBackDoor.Remcos.438
ESET-NOD32a variant of Win32/Rescoms.B
ElasticWindows.Trojan.Remcos
EmsisoftGeneric.Remcos.4254337F (B)
F-SecureBackdoor.BDS/Backdoor.Gen
FireEyeGeneric.mg.6055716727c9a3d3
FortinetW32/Rescoms.U!tr
GDataGeneric.Remcos.4254337F
GoogleDetected
GridinsoftBackdoor.Win32.Remcos.sa
IkarusBackdoor.Remcos
JiangminBackdoor.Remcos.dzw
K7AntiVirusTrojan ( 0053ac2c1 )
K7GWTrojan ( 0053ac2c1 )
KasperskyHEUR:Backdoor.Win32.Remcos.gen
Kingsoftmalware.kb.a.1000
LionicTrojan.Win32.Remcos.m!c
MalwarebytesGeneric.Malware.AI.DDS
MaxSecureTrojan.Malware.121218.susgen
McAfeeRemcos-FDQO!6055716727C9
McAfeeDReal Protect-LS!6055716727C9
MicroWorld-eScanGeneric.Remcos.4254337F
MicrosoftBackdoor:Win32/Remcos.GA!MTB
NANO-AntivirusTrojan.Win32.Rescoms.kqldxd
Paloaltogeneric.ml
PandaTrj/Genetic.gen
RisingBackdoor.Remcos!1.BAC7 (CLASSIC)
SUPERAntiSpywareTrojan.Agent/Gen-Crypt
SangforTrojan.Win32.Save.a
SentinelOneStatic AI - Malicious PE
SkyhighBehavesLike.Win32.Remcos.gh
SophosMal/Remcos-B
SymantecML.Attribute.HighConfidence
TencentTrojan.Win32.Remcos.16001234
VBA32BScope.Backdoor.Remcos
VIPREGeneric.Remcos.4254337F
VaristW32/Trojan.TEVC-5559
ViRobotTrojan.Win.Z.Remcos.494592.ZT
VirITTrojan.Win32.Remcos.HCY
WebrootW32.Trojan.Remcos
YandexTrojan.Rescoms!PSu4l5XLhE8
ZillyaTrojan.Rescoms.Win32.1913
ZoneAlarmHEUR:Backdoor.Win32.Remcos.gen
alibabacloudBackdoor:Win/Remcos
huorongBackdoor/Remcos.k

Network contacts

192.169.69.26 192.3.101.153 178.237.33.50

DNS requests

danbana.duckdns.org geoplugin.net

Process list

NameCommand line
17290972859113f7995b23df55ec0b2b7ae16822e0e59b575d2cfb603e79ed2793266980db734.dat-decod.exe
17290972859113f7995b23df55ec0b2b7ae16822e0e59b575d2cfb603e79ed2793266980db734.dat-decod.exe/stext "%TEMP%\nisoyjbvciplibsthjqbqjg"
17290972859113f7995b23df55ec0b2b7ae16822e0e59b575d2cfb603e79ed2793266980db734.dat-decod.exe/stext "%TEMP%\xkxyzcloqqhqlhoxzuldtwaomut"
17290972859113f7995b23df55ec0b2b7ae16822e0e59b575d2cfb603e79ed2793266980db734.dat-decod.exe/stext "%TEMP%\iekrzmwqeyzdvndjifywebnfvblwaz"
17290972859113f7995b23df55ec0b2b7ae16822e0e59b575d2cfb603e79ed2793266980db734.dat-decod.exe/stext "%TEMP%\pmpmeihuzwvhxonkoptj"
17290972859113f7995b23df55ec0b2b7ae16822e0e59b575d2cfb603e79ed2793266980db734.dat-decod.exe/stext "%TEMP%\zgvexaswnfnuhuboyzgktai"
17290972859113f7995b23df55ec0b2b7ae16822e0e59b575d2cfb603e79ed2793266980db734.dat-decod.exe/stext "%TEMP%\kiixytcpbnfzjixahktmwfvqswx"
17290972859113f7995b23df55ec0b2b7ae16822e0e59b575d2cfb603e79ed2793266980db734.dat-decod.exe/stext "%TEMP%\esridtrxcosthxmkzawjko"
17290972859113f7995b23df55ec0b2b7ae16822e0e59b575d2cfb603e79ed2793266980db734.dat-decod.exe/stext "%TEMP%\omxbemczqwkyrdjoilqcnblkc"
17290972859113f7995b23df55ec0b2b7ae16822e0e59b575d2cfb603e79ed2793266980db734.dat-decod.exe/stext "%TEMP%\qocteemsmeudusxarwdeyfgtksaza"
17290972859113f7995b23df55ec0b2b7ae16822e0e59b575d2cfb603e79ed2793266980db734.dat-decod.exe/stext "%TEMP%\nfhwgdfubllqd"
17290972859113f7995b23df55ec0b2b7ae16822e0e59b575d2cfb603e79ed2793266980db734.dat-decod.exe/stext "%TEMP%\phuphwynptdvonnb"
17290972859113f7995b23df55ec0b2b7ae16822e0e59b575d2cfb603e79ed2793266980db734.dat-decod.exe/stext "%TEMP%\abahaojpdbvaqubfdtt"
17290972859113f7995b23df55ec0b2b7ae16822e0e59b575d2cfb603e79ed2793266980db734.dat-decod.exe/stext "%TEMP%\macyhfaqoqujpvjatcj"
17290972859113f7995b23df55ec0b2b7ae16822e0e59b575d2cfb603e79ed2793266980db734.dat-decod.exe/stext "%TEMP%\pciiixkjkymozbfednwzwdr"
17290972859113f7995b23df55ec0b2b7ae16822e0e59b575d2cfb603e79ed2793266980db734.dat-decod.exe/stext "%TEMP%\zwvbiqvlygebcpuimxqbzpefvo"