MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 23723f9b4239194a21bf0df559f9e9df8aec1399899346311c09cdcd91a9f1b0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	23723f9b4239194a21bf0df559f9e9df8aec1399899346311c09cdcd91a9f1b0
SHA3-384 hash:	c6c114853014e7f5ca9a7f1d0fb3945f587b5d29507597edce1177493e00fb16611c057edaacd2995432546322fb888e
SHA1 hash:	2c0f959b61081a10a085ad8e8f8741a69e2d9934
MD5 hash:	183d51767fe58e2bd256688315d25709
humanhash:	texas-virginia-maine-juliet
File name:	secondaryTask.vbs
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	876 bytes
First seen:	2024-11-30 00:23:16 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	24:PAilGdehX66xyIpDkJbJ4CQjamgX3TX83qpz/7:P9GaZpDkNSKZzD
Threatray	4'629 similar samples on MalwareBazaar
TLSH	T16B116F4D8EBE8673EDB403F255FF31848BCC640180A9541F25A7A8342681C0587676DF
Magika	vba
Reporter	aachum
Tags:	RemcosRAT vbs

iamaachum

Remcos C2: 185.157.162.126:1995

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

130

Origin country :

ES

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.2447.18981.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=674a5c6ee64d1c722d7a4685

Tags:

remcos virus gates overt

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

cmd evasive lolbin msiexec remote

Link:

https://www.filescan.io/uploads/674a5b222369b8c7bbfe2d79/reports/8086458d-b307-4e57-9cec-50109178202b/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/23723f9b4239194a21bf0df559f9e9df8aec1399899346311c09cdcd91a9f1b0

Joe Sandbox Clipboard Hijacker, MicroClip, Remcos

Result

Threat name:

Clipboard Hijacker, MicroClip, Remcos

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1565487

Signature

AI detected suspicious sample

Allocates memory in foreign processes

Antivirus detection for dropped file

C2 URLs / IPs found in malware configuration

Found API chain indicative of debugger detection

Found direct / indirect Syscall (likely to bypass EDR)

Found hidden mapped module (file has been removed from disk)

Found malware configuration

Injects a PE file into a foreign processes

Installs a MSI (Microsoft Installer) remotely

Machine Learning detection for dropped file

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Potential evasive VBS script found (sleep loop)

Sigma detected: WScript or CScript Dropper

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

VBScript performs obfuscated calls to suspicious functions

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Yara detected Clipboard Hijacker

Yara detected MicroClip

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/23723f9b4239194a21bf0df559f9e9df8aec1399899346311c09cdcd91a9f1b0

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/23723f9b4239194a21bf0df559f9e9df8aec1399899346311c09cdcd91a9f1b0/

ReversingLabs TitaniumCloud Script-WScript.Backdoor.Remcos

Threat name:

Script-WScript.Backdoor.Remcos

Alert

Create hunting rule

Status:

Suspicious

First seen:

2024-11-29 07:01:01 UTC

File Type:

Text (VBS)

AV detection:

5 of 24 (20.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=enzd7g2chemuuin7bx2vt6pj36foye4zrgjummi4bhg43enj6gya._file

Threatray remcos

Verdict:

malicious

Label(s):

remcos

Alert

Create hunting rule

Similar samples:

6ed0c218b751ec93293b5922e783b7a9b147a3c7cd6070022cd707050108d321

RemcosRAT

b2a1e0e508be9c7546a8af45c72f2032f067ac036f03ec0c8309b368b195a65c

RemcosRAT

e375d127ede7c4f45893d14e94e334672688b4861a5e2dfe54deda05a67b6727

RemcosRAT

e483ca3bc78e49f0ceef3406ea963101fe1d2b08b4bace6945ac9298222b8c37

RemcosRAT

error

RemcosRAT

f57e0e55aa4691d0502f6da67d4ecb2823c98bd319c5208ae44a518a0a17392b

RemcosRAT

f5dfa6b5d19d9334c69d24dd98f13cb30badacb6403b03afc47af4e267cbe0c2

RemcosRAT

fc7beeae6b795561f216733b82611c8db1643cc883ded6fbca9c447c7a985358

RemcosRAT

+ 4'619 additional samples on MalwareBazaar

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:hijackloader family:remcos botnet:v2 discovery loader rat

Link:

https://tria.ge/reports/241130-ap2yvatqat/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

NSIS installer

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Windows directory

Suspicious use of SetThreadContext

Blocklisted process makes network request

Enumerates connected drives

Legitimate hosting services abused for malware hosting/C2

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Use of msiexec (install) with remote resource

Detects HijackLoader (aka IDAT Loader)

HijackLoader

Hijackloader family

Remcos

Remcos family

Malware Config

C2 Extraction:

185.157.162.126:1995

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.38

Link:

https://yomi.yoroi.company/submissions/23723f9b4239194a21bf0df559f9e9df8aec1399899346311c09cdcd91a9f1b0