MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 62db7e02b51b89f767c5740bb8569668ddcf134b2865959d9fc7a749209d0539. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 62db7e02b51b89f767c5740bb8569668ddcf134b2865959d9fc7a749209d0539
SHA3-384 hash: 0ab3f77085d9346163aeda49a2e3ebd764838a4913d80db4e76c3ef3b9306c4723b24867a0afbd2ea4672989c1d97d83
SHA1 hash: f73ba378275e5bc2492e53b63c96c22f35599ffc
MD5 hash: 76277ab4bde108fed474724b88ad0e39
humanhash: beryllium-sodium-avocado-earth
File name:nicewithgreatfeaturesreturnformebestthingsgivensoofar.hta
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:83'281 bytes
First seen:2024-12-11 10:21:19 UTC
Last seen:2024-12-13 09:50:49 UTC
File type:HTML Application (hta) hta
MIME type:text/html
ssdeep 768:tmbUZA+cT/RVeU2Dx6AyZ6LAuAHAbvOx7ze2pe2Ju2x4/mlpu6ae28RWHTuQBwxW:tD
TLSH T17C837A07554BD93C7F87A9FBE33CD92A22C6AD11EF8E890706FC095519D5F8EB024894
Magika javascript
Reporter abuse_ch
Tags:hta RemcosRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
81
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
PUA.Html.Trojan.Crypt-358
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=675968f97767f0db2ec4e3c1
Tags:
obfuscate shell sage
Result
Verdict:
Malicious
File Type:
HTA File - Malicious
Link:
https://app.docguard.net/62db7e02b51b89f767c5740bb8569668ddcf134b2865959d9fc7a749209d0539/results/dashboard
Payload URLs
URL
File name
http://23.95.235.29/808/verynicecreamychickenfvouratedishesforeveryonewhoinonlinewith.tIF
HTA File
Behaviour
BlacklistAPI detected
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/675967ce143026d578ec06d4/reports/d5b21595-acfb-46ae-bad1-5f825e28ba0d/overview
Verdict:
Malicious
Labled as:
VBS.Asthma.2.9205DEF7
Link:
https://www.hybrid-analysis.com/sample/62db7e02b51b89f767c5740bb8569668ddcf134b2865959d9fc7a749209d0539
Result
Verdict:
MALICIOUS
Details
Hidden Powershell
Detected a pivot to Powershell that utilizes commonly nefarious attributes such as '-windowstyle hidden'.
Base64 Encoded URL
Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.
Result
Threat name:
Cobalt Strike, Remcos
Create hunting rule
Detection:
malicious
Classification:
rans.spre.phis.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1572997
Signature
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Connects to a pastebin service (likely for C&C)
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to inject code into remote processes
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Delayed program exit found
Detected Cobalt Strike Beacon
Detected Remcos RAT
Found malware configuration
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
PowerShell case anomaly found
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Remcos
Sigma detected: Script Initiated Connection to Non-Local Network
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious command line found
Suspicious execution chain found
Suspicious powershell command line found
System process connects to network (likely due to code injection or exploit)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected obfuscated html page
Yara detected Powershell decode and execute
Yara detected Powershell download and execute
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Yara detected VBS Downloader Generic
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1572997 Sample: nicewithgreatfeaturesreturn... Startdate: 11/12/2024 Architecture: WINDOWS Score: 100 58 paste.ee 2->58 60 192.3.101.149 AS-COLOCROSSINGUS United States 2->60 62 2 other IPs or domains 2->62 80 Suricata IDS alerts for network traffic 2->80 82 Found malware configuration 2->82 84 Malicious sample detected (through community Yara rule) 2->84 88 17 other signatures 2->88 13 mshta.exe 1 2->13         started        signatures3 86 Connects to a pastebin service (likely for C&C) 58->86 process4 signatures5 108 Suspicious command line found 13->108 110 PowerShell case anomaly found 13->110 16 cmd.exe 1 13->16         started        process6 signatures7 68 Detected Cobalt Strike Beacon 16->68 70 Suspicious powershell command line found 16->70 72 Wscript starts Powershell (via cmd or directly) 16->72 74 PowerShell case anomaly found 16->74 19 powershell.exe 42 16->19         started        24 conhost.exe 16->24         started        process8 dnsIp9 64 23.95.235.29, 49704, 80 AS-COLOCROSSINGUS United States 19->64 48 verynicecreamychic...sforeveryonewho.vbS, Unicode 19->48 dropped 50 C:\Users\user\AppData\...\hfnnhv5z.cmdline, Unicode 19->50 dropped 52 verynicecreamychic...nonlinewith[1].tiff, Unicode 19->52 dropped 90 Loading BitLocker PowerShell Module 19->90 26 wscript.exe 14 19->26         started        30 csc.exe 3 19->30         started        file10 signatures11 process12 dnsIp13 66 paste.rs 45.63.94.214, 443, 49705 AS-CHOOPAUS United States 26->66 100 System process connects to network (likely due to code injection or exploit) 26->100 102 Detected Cobalt Strike Beacon 26->102 104 Suspicious powershell command line found 26->104 106 3 other signatures 26->106 33 powershell.exe 15 16 26->33         started        54 C:\Users\user\AppData\Local\...\hfnnhv5z.dll, PE32 30->54 dropped 37 cvtres.exe 1 30->37         started        file14 signatures15 process16 dnsIp17 56 paste.ee 104.21.84.67, 443, 49742 CLOUDFLARENETUS United States 33->56 76 Writes to foreign memory regions 33->76 78 Injects a PE file into a foreign processes 33->78 39 AddInProcess32.exe 2 33->39         started        42 conhost.exe 33->42         started        signatures18 process19 signatures20 92 Contains functionality to bypass UAC (CMSTPLUA) 39->92 94 Detected Remcos RAT 39->94 96 Contains functionalty to change the wallpaper 39->96 98 7 other signatures 39->98 44 iexplore.exe 1 39->44         started        process21 process22 46 conhost.exe 44->46         started       
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/62db7e02b51b89f767c5740bb8569668ddcf134b2865959d9fc7a749209d0539
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/62db7e02b51b89f767c5740bb8569668ddcf134b2865959d9fc7a749209d0539/
Threat name:
Script-WScript.Trojan.Remcos
Create hunting rule
Status:
Malicious
First seen:
2024-12-11 08:40:28 UTC
File Type:
Text (JavaScript)
AV detection:
9 of 24 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mlnx4avvdoe7oz6foqf3qvuwndo46e2lfbszlhm7y6tusie5au4q._file
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost defense_evasion discovery execution phishing rat
Link:
https://tria.ge/reports/241211-md8cpsyld1/
Behaviour
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Command and Scripting Interpreter: PowerShell
Checks computer location settings
Blocklisted process makes network request
Evasion via Device Credential Deployment
Remcos
Remcos family
Malware Config
C2 Extraction:
192.3.101.149:6946
Dropper Extraction:
https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg%20
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/62db7e02b51b89f767c5740bb8569668ddcf134b2865959d9fc7a749209d0539

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:RansomPyShield_Antiransomware
Create hunting rule
Author:XiAnzheng
Description:Check for Suspicious String and Import combination that Ransomware mostly abuse(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

HTML Application (hta) hta 62db7e02b51b89f767c5740bb8569668ddcf134b2865959d9fc7a749209d0539

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3344970/
  
Delivery method
Distributed via web download

Comments