MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ce99f1c6f64c4e7e622285ed1eb35fd8c2dc4615f15a674e829968ac2cdfcc7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6ce99f1c6f64c4e7e622285ed1eb35fd8c2dc4615f15a674e829968ac2cdfcc7
SHA3-384 hash:	9f21787fd8c82c06ab5595003d03933993a9f3aad4b815741c9faf5b7f052744b62b0858bfa22115dacec178b326f50e
SHA1 hash:	ae653f829664efac18123939bbbef4444584f59e
MD5 hash:	18d427f78535ba38a55cc99a5f70554f
humanhash:	cup-equal-nineteen-utah
File name:	createdbestthinsgsforme.hta
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	49'349 bytes
First seen:	2026-03-18 10:22:40 UTC
Last seen:	Never
File type:	hta
MIME type:	text/html
ssdeep	192:L3lZYZFZqCZcJxvoZkZ2vhMYsYVYiYGYp3Y6YtYtvEYjY2KRtOocekmh3:7FiMzaDr237EnGzKdcen3
TLSH	T12623F8155FE008E5ABEB3ED068A0FE51098AE93F02716B7438DD01DD8B417DE2D76721
Magika	html
Reporter	abuse_ch
Tags:	hta RemcosRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

94

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69ba7d2188c80c01586b97de

Tags:

xtreme shell sage

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/6ce99f1c6f64c4e7e622285ed1eb35fd8c2dc4615f15a674e829968ac2cdfcc7/results/dashboard

Payload URLs

URL

File name

http://107.173.143.35/122/goodthingsbestforme.vbs

HTA File

Behaviour

BlacklistAPI detected

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

powershell powershell pterodo

Link:

https://www.filescan.io/uploads/69ba7d17493cb7d62d040b3d/reports/5327ff44-583a-4684-8291-081fc0fa7ff8/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/6ce99f1c6f64c4e7e622285ed1eb35fd8c2dc4615f15a674e829968ac2cdfcc7

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

html

First seen:

2026-03-18T07:52:00Z UTC

Last seen:

2026-03-18T09:33:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Script.Generic HEUR:Trojan.HTA.SAgent.gen

Link:

https://opentip.kaspersky.com/6ce99f1c6f64c4e7e622285ed1eb35fd8c2dc4615f15a674e829968ac2cdfcc7/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1885571

Signature

Antivirus detection for URL or domain

Bypasses PowerShell execution policy

Creates processes via WMI

Encrypted powershell cmdline option found

Found suspicious powershell code related to unpacking or dynamic code loading

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

PowerShell case anomaly found

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/6ce99f1c6f64c4e7e622285ed1eb35fd8c2dc4615f15a674e829968ac2cdfcc7

Malva.RE

Gathering data

CERT.PL MWDB remcos

Detection:

remcos

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/6ce99f1c6f64c4e7e622285ed1eb35fd8c2dc4615f15a674e829968ac2cdfcc7/

Neiki Family.REMCOSRAT

Verdict:

Malicious

Threat:

Family.REMCOSRAT

Link:

https://tip.neiki.dev/file/6ce99f1c6f64c4e7e622285ed1eb35fd8c2dc4615f15a674e829968ac2cdfcc7

ReversingLabs TitaniumCloud Win32.Trojan.Electryon

Threat name:

Win32.Trojan.Electryon

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-03-18 09:55:02 UTC

File Type:

Text (HTML)

Extracted files:

1

AV detection:

9 of 24 (37.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ntuz6hdpmtcopzrcfbpnd2zv7wgc3rdbl4k2m5hifglivqwn7tdq._file

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos botnet:prosper discovery execution rat

Link:

https://tria.ge/reports/260318-mezf7afz8t/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Checks computer location settings

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Process spawned unexpected child process

Remcos

Remcos family

Malware Config

C2 Extraction:

jimguy922.duckdns.org:37183

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/6ce99f1c6f64c4e7e622285ed1eb35fd8c2dc4615f15a674e829968ac2cdfcc7