f35b6cb6af991bfa735e039f6bc0e49c69759c015a207.exe
Classification: Malicious
f35b6cb6af991bfa735e039f6bc0e49c69759c015a207.exe is a backdoor (Windows executable). Detected by 63 antivirus engines. Linked to Remcos, Crossrat malware.
Detection summary
- 63 antivirus detections
- 2 IDS alerts
- 0 processes observed
- 2 contacted hosts
- 2 DNS requests
MITRE ATT&CK associations
Malware families: REMCOS (S0332) CROSSRAT (S0235)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| CrossRAT | ThreatFox Abuse.ch | 2026-07-10 14:54:45 | 2026-07-10 15:25:04 | S0235 CrossRAT | |
| RemcosRAT | MalwareBazaar Abuse.ch | 2026-07-10 03:10:16 | 2026-07-10 03:10:16 | malicious-activity | S0332 Remcos |
| Generic Malware | Hybrid-Analysis | 2026-07-09 20:45:04 | 2026-07-09 20:45:04 | malicious-activity | |
| Remcos | Triage | 2026-07-09 20:09:03 | 2026-07-09 20:09:03 | malicious-activity | S0332 Remcos |
Tags
infostealer suspicious windows-server-utility remcos flamengo discovery rat suricata jar.crossrat truptoSample information
- Filenames
- f35b6cb6af991bfa735e039f6bc0e49c69759c015a207.exe, f35b6cb6af991bfa735e039f6bc0e49c69759c015a2074b87eed8f20e4200135.exe, f35b6cb6af991bfa735e039f6bc0e49c69759c015a2074b87eed8f20e4200135.bin
- File type
- PE32 executable for MS Windows 5.01 (GUI), Intel i ...
- MD5
654607f31a256d943a2de9b63b30929c- SHA-1
679fb2dbfe81808a883729d15cd03b99eda8d1ba- SHA-256
f35b6cb6af991bfa735e039f6bc0e49c69759c015a2074b87eed8f20e4200135- First indexed
- 2026-07-09 20:09:03
- Last updated
- 2026-09-18 00:01:20
Antivirus detections
| Engine | Detection |
|---|---|
| ALYac | Gen:Variant.Remcos.23 |
| APEX | Malicious |
| AVG | Win32:MalwareX-gen [Rat] |
| AhnLab-V3 | Backdoor/Win.Remcos.R688952 |
| Alibaba | Backdoor:Win32/Remcos.e42b9f79 |
| Antiy-AVL | Trojan[Backdoor]/Win32.Remcos |
| Arcabit | Trojan.Remcos.23 |
| Avast | Win32:MalwareX-gen [Rat] |
| Avira | BDS/Backdoor.Gen |
| BitDefender | Gen:Variant.Remcos.23 |
| Bkav | W32.Malware.C7B99A51 |
| CAT-QuickHeal | Backdoor.RemcosPMF.S34700672 |
| CTX | exe.trojan.remcos |
| ClamAV | Win.Trojan.Remcos-9841897-0 |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cylance | Unsafe |
| Cynet | Malicious (score: 100) |
| DeepInstinct | MALICIOUS |
| DrWeb | BackDoor.Remcos.473 |
| ESET-NOD32 | Win32/Rescoms.B trojan |
| Elastic | Windows.Trojan.Remcos |
| Emsisoft | Gen:Variant.Remcos.23 (B) |
| F-Secure | Backdoor.BDS/Backdoor.Gen |
| Fortinet | W32/Rescoms.U!tr |
| GData | Gen:Variant.Remcos.23 |
| Detected | |
| Gridinsoft | Backdoor.Win32.Remcos.oa!s1 |
| Jiangmin | Backdoor.Remcos.eeh |
| K7AntiVirus | Backdoor ( 005cecdb1 ) |
| K7GW | Backdoor ( 005cecdb1 ) |
| Kaspersky | HEUR:Backdoor.Win32.Remcos.gen |
| Kingsoft | Win32.Hack.Remcos.gen |
| Lionic | Trojan.Win32.Remcos.4!c |
| Malwarebytes | Backdoor.Remcos |
| MaxSecure | Trojan.Malware.300983.susgen |
| McAfeeD | Real Protect-LS!654607F31A25 |
| MicroWorld-eScan | Gen:Variant.Remcos.23 |
| Microsoft | Backdoor:Win32/Remcos.GA!MTB |
| NANO-Antivirus | Trojan.Win32.Remcos.kuophh |
| Paloalto | generic.ml |
| Panda | Trj/PhxBzA.A |
| Rising | Backdoor.Remcos!1.BAC7 (CLASSIC) |
| SUPERAntiSpyware | Trojan.Agent/Gen-Kryptik |
| Sangfor | Trojan.Win32.Save.a |
| SentinelOne | Static AI - Malicious PE |
| Skyhigh | BehavesLike.Win32.NetLoader.gh |
| Sophos | Troj/Remcos-APM |
| Symantec | Backdoor.Remcos!gen5 |
| Tencent | Trojan.Win32.Remcos.16001234 |
| TrellixENS | Remcos!654607F31A25 |
| TrendMicro | Backdoor.Win32.REMCOS.TL0101GD26ZZ |
| TrendMicro-HouseCall | Trojan.Win32.VSX.PE04CA5 |
| VBA32 | Backdoor.Remcos |
| VIPRE | Gen:Variant.Remcos.23 |
| Varist | W32/Agent.JUB.gen!Eldorado |
| ViRobot | Trojan.Win.Z.Remcos.493056.HB |
| VirIT | Trojan.Win32.Genus.XKM |
| Webroot | Win.Trojan.Remcos |
| Yandex | Trojan.Rescoms!6BIR/qxGILU |
| Zillya | Trojan.Rescoms.Win32.2095 |
| ZoneAlarm | Troj/Remcos-APM |
| alibabacloud | Backdoor:Win/Remcos |
| huorong | Backdoor/Remcos.k |