MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3aab7da6638b01ad4e67ea2d430236acd69b5fb4706c2b17af6a782e8939eda9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	3aab7da6638b01ad4e67ea2d430236acd69b5fb4706c2b17af6a782e8939eda9
SHA3-384 hash:	c34bcea69c55f3dfc7205a9887276d7e0daf1a968210abac5e22a41c2e068ac30d6dc894c3b8d5cf1e714f6440bfc5c8
SHA1 hash:	9b47d5e4b18c9fbd402c3cb7256f1c0e1cafd5a8
MD5 hash:	69e0443cd3b4c4e239dc93df37b4aad8
humanhash:	autumn-double-massachusetts-island
File name:	greathappinessentiretimeformegetback.hta
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	46'300 bytes
First seen:	2025-05-23 14:47:23 UTC
Last seen:	Never
File type:	hta
MIME type:	text/html
ssdeep	384:gpdFOqr9OVryK9svetKLN/cXpb3bbfnO0OwIr5Otl:0Vhcdffl
TLSH	T18823F4F5CB3B217F2AAC26D09E59D791C0BDA8736A1E1159E6083BD845A1C0533ECB0F
Magika	txt
Reporter	abuse_ch
Tags:	hta RemcosRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

75

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.JS.Starter.96.14509.4916.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=683097c244c3881e854c6f7a

Tags:

obfuscate shell sage

DocGuard Clean

Result

Verdict:

Clean

File Type:

HTA File

Link:

https://app.docguard.net/3aab7da6638b01ad4e67ea2d430236acd69b5fb4706c2b17af6a782e8939eda9/results/dashboard

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/3aab7da6638b01ad4e67ea2d430236acd69b5fb4706c2b17af6a782e8939eda9

Joe Sandbox Cobalt Strike, Remcos

Result

Threat name:

Cobalt Strike, Remcos

Alert

Create hunting rule

Detection:

malicious

Classification:

rans.phis.troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1698142

Signature

Antivirus detection for dropped file

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to bypass UAC (CMSTPLUA)

Contains functionality to register a low level keyboard hook

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Contains functionalty to change the wallpaper

Detected Cobalt Strike Beacon

Detected Remcos RAT

Found hidden mapped module (file has been removed from disk)

Found malware configuration

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

PowerShell case anomaly found

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Remcos

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious command line found

Suspicious execution chain found

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Uses threadpools to delay analysis

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Yara detected AntiVM3

Yara detected Powershell decode and execute

Yara detected Powershell download and execute

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

Yara detected WebBrowserPassView password recovery tool

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/3aab7da6638b01ad4e67ea2d430236acd69b5fb4706c2b17af6a782e8939eda9

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3aab7da6638b01ad4e67ea2d430236acd69b5fb4706c2b17af6a782e8939eda9/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-05-23 15:40:25 UTC

File Type:

Text (JavaScript)

AV detection:

7 of 38 (18.42%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hkvx3jtdrma22tth5iwugarwvtljwx5uobwcwf5pnj4c5cjz5wuq._file

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos botnet:remotehost collection defense_evasion discovery execution rat

Link:

https://tria.ge/reports/250523-s4dhxaer4t/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook accounts

Checks computer location settings

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Evasion via Device Credential Deployment

Detected Nirsoft tools

NirSoft MailPassView

NirSoft WebBrowserPassView

Remcos

Remcos family

Malware Config

C2 Extraction:

172.245.208.27:1070

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Remcos

Threat name:

Remcos

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/3aab7da6638b01ad4e67ea2d430236acd69b5fb4706c2b17af6a782e8939eda9