MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2c3f31c3ee37440e580e755960537e13511027a95e9539da15c3984a8a20be9f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2c3f31c3ee37440e580e755960537e13511027a95e9539da15c3984a8a20be9f
SHA3-384 hash:	abb8bbc685e86e2faef2d6c36b27f99ff85ac1cedc3451179dc97d04ac0d8698fba32689a5dddd7691048e5b0d9a5dd2
SHA1 hash:	378cda397934d0972d4b645f464345d8a2a9f95e
MD5 hash:	52deea1d4fa4c9eb9a4e16cc9ad4fede
humanhash:	king-ceiling-uniform-mobile
File name:	sweetnessgoodforbetterplacewithgreatnessforme.hta
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	3'446 bytes
First seen:	2025-06-24 15:47:32 UTC
Last seen:	2025-06-27 13:02:15 UTC
File type:	hta
MIME type:	text/html
ssdeep	48:4JI9iSYrXdYffWqKtvzmkyEBEMQE5Qmod91iDEzn7oGoz2Q:46EXgZEfFclZA2Q
Threatray	1'171 similar samples on MalwareBazaar
TLSH	T12C61148E783158BC8F218997D45AB979D0F08E93F0987C7091A96CA25F50D9DE18CFCE
Magika	txt
Reporter	abuse_ch
Tags:	hta newstartnewjournyevamygirllovesalotwithm-duckdns-org RemcosRAT

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

69

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Agent-9.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.JS.Obfus-95.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=685ac8cdb06783b9ebd6ddcc

Tags:

obfuscate xtreme shell

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/2c3f31c3ee37440e580e755960537e13511027a95e9539da15c3984a8a20be9f/results/dashboard

Behaviour

BlacklistAPI detected

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/2c3f31c3ee37440e580e755960537e13511027a95e9539da15c3984a8a20be9f

Joe Sandbox HTMLPhisher

Result

Threat name:

HTMLPhisher

Alert

Create hunting rule

Detection:

malicious

Classification:

spre.phis.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1722029

Signature

Command shell drops VBS files

Multi AV Scanner detection for submitted file

Potential malicious VBS script found (suspicious strings)

Sigma detected: Legitimate Application Dropped Script

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

System process connects to network (likely due to code injection or exploit)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Yara detected HtmlPhish44

Yara detected VBS Downloader Generic

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

3%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/2c3f31c3ee37440e580e755960537e13511027a95e9539da15c3984a8a20be9f

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

2 match(es)

Tags:

Html

Link:

https://app.malva.re/file/52deea1d4fa4c9eb9a4e16cc9ad4fede

CERT.PL MWDB remcos

Detection:

remcos

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/2c3f31c3ee37440e580e755960537e13511027a95e9539da15c3984a8a20be9f/

Neiki Malicious

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/2c3f31c3ee37440e580e755960537e13511027a95e9539da15c3984a8a20be9f

ReversingLabs TitaniumCloud Script-WScript.Trojan.Heuristic

Threat name:

Script-WScript.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-06-24 15:29:54 UTC

File Type:

Text (HTML)

Extracted files:

1

AV detection:

9 of 24 (37.50%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fq7tdq7og5ca4waoovmwau36cniraj5jl2kttwqvyomevcrax2pq._file

Threatray admintool_mailpassview nirsoft remcos

Verdict:

malicious

Label(s):

admintool_mailpassview

Alert

Create hunting rule

nirsoft

Alert

Create hunting rule

remcos

Alert

Create hunting rule

Similar samples:

11d67ce2068437cce35f0b601119ebd071921f536daa8a5afff7c4d03ff1a4bc

RemcosRAT

1a8c4a357230c2b388cb9cc9171ab0bcc37a194fdf99e69e6a42d8e1a3d2652b

RemcosRAT

1f0573e1fd20ac052c3593942274cb9c892c3dba6766ddc5ccb557a01ffd5d97

RemcosRAT

36e0589d6c7fe2ba454673e8ad1becbd09d60838d80f95ba4f7c4cbfa635816c

RemcosRAT

42b3442bc675f7ff95d660935ea8756710fea99551b1d614f2e8b7db739d72a0

RemcosRAT

548130edd9e2a0fc302a475316a4fbc2a2e2351c4f92f19ba73bfb72d10fe299

RemcosRAT

8ba912704a7e4f686d5f29c0277b52fbfdeb1d1708bab9c6d0e06eb48f8dc539

RemcosRAT

d2a87b1b1a1106b874e949e49a55e7e68202eaa84062c270bbf62481bb769a45

RemcosRAT

error

RemcosRAT

f5147495983f1e0eb0d595bcced8d5fceedfef286909fe6f213760c0742493ac

RemcosRAT

f843cdcee44e6298aee3865d30fd491856a0ca2e26a463f81096b7dcf2c908a7

RemcosRAT

+ 1'161 additional samples on MalwareBazaar

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos botnet:evangle collection discovery execution rat

Link:

https://tria.ge/reports/250624-s8v9hsvjt4/

Behaviour

Delays execution with timeout.exe

Script User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook accounts

Checks computer location settings

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Detected Nirsoft tools

NirSoft MailPassView

NirSoft WebBrowserPassView

Remcos

Remcos family

Malware Config

C2 Extraction:

newstartnewjournyevamygirllovesalotwithm.duckdns.org:14646

Dropper Extraction:

http://149.154.158.50/xampp/cb/wp4096799-lost-in-space-wallpapers.jpg

VMRay Remcos

Malware family:

Remcos

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/2c3f31c3ee37/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2c3f31c3ee37440e580e755960537e13511027a95e9539da15c3984a8a20be9f