MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 54f31ce59673bcee805a240b73cddfa6b2966c034e17776697cab82106dd99cd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	54f31ce59673bcee805a240b73cddfa6b2966c034e17776697cab82106dd99cd
SHA3-384 hash:	5d2faa00bbc469c0d678484aae931917103ea43edfd82e3b529660d9ad7d4d74cda45feb829a00db420fbdb4b97b0e54
SHA1 hash:	8cc07b354f894428e89e30b70ccf62aced1949e8
MD5 hash:	9f78f69a37e20e6372bbd17fadbaa5f7
humanhash:	utah-delta-alaska-football
File name:	nHHA_ASSOCIATES.tar
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	110'001 bytes
First seen:	2026-06-09 11:30:09 UTC
Last seen:	Never
File type:	tar
MIME type:	application/x-rar
ssdeep	1536:e1RA120N5uaFsmKA6r1toHjXMr3zf60QDZWJ9ZKXnhRqFT53U/J6KdVbCvU+:gRehNVsZZtbHf6noTo3hRqF53YLsvU+
TLSH	T1E8B312F3E70C7822D105A561477A701B74887034B66DAFE7352ADD00A97BC52A17BEE3
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	FXOLabs
Tags:	RemcosRAT tar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

47

Origin country :

BR

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	HHA ASSOCIATES SDN BHD - DOCUMENTS(RFQ,BOQ,SCOPE OR WORK).js
File size:	810'508 bytes
SHA256 hash:	df7f480c5a771425c1725f58524451d09439ba68934b63e09662e6dc2936b0af
MD5 hash:	8fd35c2c1107e8dc0d62cfff2a36a909
MIME type:	text/plain
Signature	RemcosRAT

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/e3c25319-f4ad-4a4d-832c-03dc6bcda06d/

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.JS_Rar_1.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a27f97234eaf30d8ce43d11

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

conhost obfuscated powershell repaired

Link:

https://www.filescan.io/uploads/6a27f9621f652d6865723837/reports/8c2d400e-eb86-4567-8339-e808d67ada18/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/54f31ce59673bcee805a240b73cddfa6b2966c034e17776697cab82106dd99cd

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2026-06-09T10:07:00Z UTC

Last seen:

2026-06-09T10:10:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/54f31ce59673bcee805a240b73cddfa6b2966c034e17776697cab82106dd99cd/results?tab=lookup

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/54f31ce59673bcee805a240b73cddfa6b2966c034e17776697cab82106dd99cd/

Neiki Family.REMCOS

Verdict:

Malicious

Threat:

Family.REMCOS

Link:

https://tip.neiki.dev/file/54f31ce59673bcee805a240b73cddfa6b2966c034e17776697cab82106dd99cd

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-06-09 12:26:46 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

11 of 24 (45.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ktzrzzmwoo6o5ac2eqfxhto7u2zjm3adjylxozuxzk4ccbw5thgq._file

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos botnet:sirius move collection credential_access discovery execution persistence rat stealer

Link:

https://tria.ge/reports/260609-qtp3vabx9n/

Behaviour

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

outlook_office_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Time Discovery

Drops file in Program Files directory

Drops file in Windows directory

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Registers new Windows logon scripts automatically executed at logon.

Badlisted process makes network request

Uses browser remote debugging

Family: Remcos

Suspicious use of NtCreateUserProcessOtherParentProcess

Malware Config

C2 Extraction:

server.activeworkshops.com:31166

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/54f31ce59673bcee805a240b73cddfa6b2966c034e17776697cab82106dd99cd