MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 16d3ef151d14921c1b6e883ddcc218b20cee2e1e0a312a8e0c09df281237b963. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	16d3ef151d14921c1b6e883ddcc218b20cee2e1e0a312a8e0c09df281237b963
SHA3-384 hash:	f97419bfc79e6777a0b930db679a81ec323afb44b8f19ddcb20a0473ba5bd0252a26110cccd5b6132d035941c1657416
SHA1 hash:	e4d394f8f2fab1c57b01eb32175640977c4bb757
MD5 hash:	a5ecdde9d8a150611dad07079b465a95
humanhash:	red-lactose-fourteen-august
File name:	winthematchwithbestfeelingformebest.hta
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	16'027 bytes
First seen:	2026-07-21 06:13:37 UTC
Last seen:	2026-07-21 15:08:15 UTC
File type:	hta
MIME type:	text/html
ssdeep	192:BJkZuwehmMoKmkDKZNUJu9kimGKW4FLINSZYWu14trP6cQEh:TWMhmPKm/ZNUJu9cGfNLL4xP6cQEh
TLSH	T1117230379B9249F8810415BC774DA6DCB3305E0BC49D88ED6333B58AE613EAB0C436B6
Magika	html
Reporter	abuse_ch
Tags:	hta RemcosRAT

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

84

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Agent.AKR.tr.29842.14759.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a5f0e58bcffb2c48cb7a854

Tags:

obfuscate shell sage

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/16d3ef151d14921c1b6e883ddcc218b20cee2e1e0a312a8e0c09df281237b963/results/dashboard

Behaviour

BlacklistAPI detected

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 cloudeye powershell.exe

Link:

https://www.filescan.io/uploads/6a5f0e512703044d8e5942bf/reports/df40c19a-9c5e-4b96-9301-63c5d49ca5af/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/16d3ef151d14921c1b6e883ddcc218b20cee2e1e0a312a8e0c09df281237b963

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

hta

First seen:

2026-07-20T08:32:00Z UTC

Last seen:

2026-07-21T12:58:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/16d3ef151d14921c1b6e883ddcc218b20cee2e1e0a312a8e0c09df281237b963/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/1945651

Signature

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Suspicious MSHTA Child Process

Suspicious command line found

Suspicious powershell command line found

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

29%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/16d3ef151d14921c1b6e883ddcc218b20cee2e1e0a312a8e0c09df281237b963

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

3 match(es)

Tags:

Html

Link:

https://app.malva.re/file/a5ecdde9d8a150611dad07079b465a95

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/16d3ef151d14921c1b6e883ddcc218b20cee2e1e0a312a8e0c09df281237b963/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=c3j66fi5csjbyg3ora65zqqywigo4lq6biysvdqmbhpsqerxxfrq._file

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos botnet:spirit_bomber_jovita discovery execution rat suricata

Link:

https://tria.ge/reports/260721-gzpvlahy8s/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Executes a command shell one-liner

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Badlisted process makes network request

Family: Remcos

Suricata alert: REMCOS RAT Malware Inbound C2 Communication

Suricata alert: REMCOS RAT Malware Outbound C2 Communication

Malware Config

C2 Extraction:

macos.macosnimba.name:57700
macos2.macosnimba2.name:57700
macos3.macosnimba3.name:57700
westy04.karslioglu4-tr.com:57700

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/16d3ef151d14921c1b6e883ddcc218b20cee2e1e0a312a8e0c09df281237b963