MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 51c00bd17f7b7f85f6ce57210b3bf157343f682754a6d344e84c1a2c789ead0c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	51c00bd17f7b7f85f6ce57210b3bf157343f682754a6d344e84c1a2c789ead0c
SHA3-384 hash:	f500543beb3eefdf866be4c7172d0510748f094a083717dec83d18c5e7b0366c04ec1f88f4a0b4984e1f624068d96c49
SHA1 hash:	8d9823e1a61052e8cbdc02446f975bb256813c3d
MD5 hash:	bdb8ecfbcc009cf2f2f0a4ed35acb4bd
humanhash:	quebec-table-carolina-stream
File name:	wegivebestopportunitieswithbestfuturegivebestme.hta
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	8'068 bytes
First seen:	2025-06-27 13:02:08 UTC
Last seen:	Never
File type:	hta
MIME type:	text/html
ssdeep	48:4FwjLBgvtiT1XOpvO3pjqV3J/vI8ry8dcR8txAy3n3Fwl8FtI3t3qY3v3TC73vn4:4YtOKO913FwlmtKBq6vAvBL5uoZQ
TLSH	T115F1240EDA3100DD77ED484BBABDB6897670839783EE6EA1D16BBC50D5E038C6440D4E
Magika	txt
Reporter	JAMESWT_WT
Tags:	hta newstartnewjournyevamygirllovesalotwithm-duckdns-org RemcosRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

63

Origin country :

IT

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.JS.Obfus-1712.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.JS.Obfus-95.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.32166.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=685e965b37c3436779468d58

Tags:

obfuscate xtreme shell

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/51c00bd17f7b7f85f6ce57210b3bf157343f682754a6d344e84c1a2c789ead0c/results/dashboard

Behaviour

BlacklistAPI detected

Hybrid Analysis Trojan.U.Remcos

Verdict:

Suspicious

Labled as:

Trojan.U.Remcos

Link:

https://www.hybrid-analysis.com/sample/51c00bd17f7b7f85f6ce57210b3bf157343f682754a6d344e84c1a2c789ead0c

Nucleon Malprob Benign

Score:

4%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/51c00bd17f7b7f85f6ce57210b3bf157343f682754a6d344e84c1a2c789ead0c

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

2 match(es)

Tags:

Html

Link:

https://app.malva.re/file/bdb8ecfbcc009cf2f2f0a4ed35acb4bd

CERT.PL MWDB remcos

Detection:

remcos

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/51c00bd17f7b7f85f6ce57210b3bf157343f682754a6d344e84c1a2c789ead0c/

ReversingLabs TitaniumCloud Script-WScript.Trojan.Heuristic

Threat name:

Script-WScript.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-06-27 10:41:00 UTC

File Type:

Text (HTML)

Extracted files:

1

AV detection:

7 of 24 (29.17%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=khaaxul7pn7yl5wok4qqwo7rk42d62bhkstngrhijqncy6e6vuga._file

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos botnet:evangle collection discovery execution rat

Link:

https://tria.ge/reports/250627-p9xxysfq4t/

Behaviour

Delays execution with timeout.exe

Script User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook accounts

Checks computer location settings

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Detected Nirsoft tools

NirSoft MailPassView

NirSoft WebBrowserPassView

Remcos

Remcos family

Malware Config

C2 Extraction:

newstartnewjournyevamygirllovesalotwithm.duckdns.org:14646

Dropper Extraction:

http://87.106.188.21/xampp/cv/wp4096799-lost-in-space-wallpapers.jpg

VMRay Remcos

Malware family:

Remcos

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/51c00bd17f7b/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/51c00bd17f7b7f85f6ce57210b3bf157343f682754a6d344e84c1a2c789ead0c