MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 22a82f3d434fa6dfc862adae2a534d3cbf70a8db0a618f8dbe845829e7bbc2a2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	22a82f3d434fa6dfc862adae2a534d3cbf70a8db0a618f8dbe845829e7bbc2a2
SHA3-384 hash:	12ef267fc8e88ee069d297e5a5226ff7005f495255dc3268a93449200d94e4f42cc7cdb581a801b75aaf6d19497609e8
SHA1 hash:	9bbcd798210155fd9115a704c26864af1780266c
MD5 hash:	f5c17235f8192d8833cb336b9df84b53
humanhash:	victor-october-stream-lemon
File name:	Rooming list.js
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	8'666 bytes
First seen:	2025-02-18 06:47:21 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	192:99cj9DfT8YtdLYHWe9CX0lDPgdFnpHZKw3PAg77UEIe5aI:XcFQULwWefo/nR7L7p
TLSH	T1E6029C4297B50254B2F34E01D9F76472152A7BB2FD29DBEDC408418C37B1219DAABB3E
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	vba
Reporter	abuse_ch
Tags:	js RemcosRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

466

Origin country :

NL

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67b42df528ab76d43a5b9678

Tags:

ransomware xtreme shell

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/67b42d2c41f6d21e6a3c9621/reports/e202f49e-99b3-4051-8ee1-c78a1e7bce37/overview

Hybrid Analysis Trojan.JS.Agent.JS

Verdict:

Malicious

Labled as:

Trojan.JS.Agent.JS

Link:

https://www.hybrid-analysis.com/sample/22a82f3d434fa6dfc862adae2a534d3cbf70a8db0a618f8dbe845829e7bbc2a2

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox Remcos

Result

Threat name:

Remcos

Alert

Create hunting rule

Detection:

malicious

Classification:

rans.spre.phis.troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1617731

Signature

.NET source code references suspicious native API functions

Antivirus detection for URL or domain

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Connects to a pastebin service (likely for C&C)

Contains functionality to bypass UAC (CMSTPLUA)

Contains functionality to inject code into remote processes

Contains functionality to register a low level keyboard hook

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Contains functionalty to change the wallpaper

Delayed program exit found

Detected Remcos RAT

Found malware configuration

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Installs a global keyboard hook

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for submitted file

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Paste sharing url in reverse order

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Remcos

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected Generic Downloader

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

Yara detected WebBrowserPassView password recovery tool

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/22a82f3d434fa6dfc862adae2a534d3cbf70a8db0a618f8dbe845829e7bbc2a2

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/22a82f3d434fa6dfc862adae2a534d3cbf70a8db0a618f8dbe845829e7bbc2a2/

ReversingLabs TitaniumCloud Script-JS.Trojan.Heuristic

Threat name:

Script-JS.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-02-17 17:12:18 UTC

File Type:

Text (Batch)

AV detection:

7 of 37 (18.92%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ekuc6pkdj6tn7sdcvwxcuu2nhs7xbkg3bjqy7dn6qrmctz53ykra._file

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos botnet:ezeife collection defense_evasion discovery execution rat

Link:

https://tria.ge/reports/250218-hkt2faxrht/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook accounts

Command and Scripting Interpreter: PowerShell

Indicator Removal: File Deletion

Legitimate hosting services abused for malware hosting/C2

Checks computer location settings

Blocklisted process makes network request

Detected Nirsoft tools

NirSoft MailPassView

NirSoft WebBrowserPassView

Remcos

Remcos family

Malware Config

C2 Extraction:

closen.kozow.com:2404

Dropper Extraction:

https://paste.ee/d/RCF3uCUw/0

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/22a82f3d434fa6dfc862adae2a534d3cbf70a8db0a618f8dbe845829e7bbc2a2