MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 75879d86cbcb3ece0ae2586a94c84cc867af39a799b9faa20e914eea8d9e323b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 75879d86cbcb3ece0ae2586a94c84cc867af39a799b9faa20e914eea8d9e323b
SHA3-384 hash: 55f24244ffb35fab7ca46163a3d92af1eaef280b0f6af2c2320422c5468f25af9072a8449bf2bd6fb4ce668c260720c1
SHA1 hash: 80e2a9e587eb8c68f6e969b1a58a498ad3df9554
MD5 hash: ccd07811a2b885361a3495d92c2b9e61
humanhash: bluebird-alanine-cup-carolina
File name:wegivenebstthingsforbeterplaceformebetthingscoming.hta
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:8'419 bytes
First seen:2026-07-06 12:38:08 UTC
Last seen:Never
File type:HTML Application (hta) hta
MIME type:text/html
ssdeep 96:VTpkAfculHfNXsPx0mnCtmsSF9eN2v24j3ZN2+UQhXj3tKhS4Q3RTb7UVE73QNLQ:FphfculH/mnuIrBUQhzIhVQ3Rn7qyQOL
Threatray 1'373 similar samples on MalwareBazaar
TLSH T15902D297C92ECCFE6F3A163B108131C5A28D8296CD0E83337D2EA07D6767C1485F2959
Magika html
Reporter James_inthe_box
Tags:exe hta RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
152
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.HTML.HideMe-22.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a4ba1c9762b0b26f3d09e30
Tags:
n/a
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm fingerprint powershell
Link:
https://www.filescan.io/uploads/6a4ba1c479c95152f4b9571e/reports/0d96c77c-f031-4901-869a-1e2dd22f246b/overview
Verdict:
Malicious
Labled as:
Trojan.Cryxos.JS
Link:
https://www.hybrid-analysis.com/sample/75879d86cbcb3ece0ae2586a94c84cc867af39a799b9faa20e914eea8d9e323b
Verdict:
Malicious
File Type:
hta
First seen:
2026-07-06T02:24:00Z UTC
Last seen:
2026-07-08T00:04:00Z UTC
Hits:
~100
Detections:
Trojan.JS.SAgent.sb HEUR:Trojan.Script.Generic
Link:
https://opentip.kaspersky.com/75879d86cbcb3ece0ae2586a94c84cc867af39a799b9faa20e914eea8d9e323b/results?tab=lookup
Score:
76%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/75879d86cbcb3ece0ae2586a94c84cc867af39a799b9faa20e914eea8d9e323b
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/75879d86cbcb3ece0ae2586a94c84cc867af39a799b9faa20e914eea8d9e323b/
Verdict:
Malicious
Threat:
Family.REMCOS
Link:
https://tip.neiki.dev/file/75879d86cbcb3ece0ae2586a94c84cc867af39a799b9faa20e914eea8d9e323b
Threat name:
Win32.Trojan.Ravartar
Create hunting rule
Status:
Malicious
First seen:
2026-07-06 12:38:22 UTC
File Type:
Text (HTML)
Extracted files:
1
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=owdz3bwlzm7m4cxclbvjjscmzbt26onhtg47viqosfhovdm6gi5q._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
nirsoft
Create hunting rule
admintool_mailpassview
Create hunting rule
Similar samples:
24af52ae7f3afb9533d3ad2e4a845bdc69dc96388d4b98853b8dd567174a43b2
RemcosRAT
40c57fa42423325baf7c646e4c135942c28495cdfa2b8ccec3455dc341013ef7
RemcosRAT
75f0a13b548a29be733e8e7dcff844d4b2fc151aa01418b1ab0ed968c17aa040
RemcosRAT
82521f120291f02708e3787da16dbcecde8d8c93f81fae2745bc5d7d0fb0df62
RemcosRAT
adac9865fbb10c53cae9f3d670bf07270274d7f0ba7732a115c4e46f73c48d09
RemcosRAT
bd508ca26a1917807c4daba2f960be5243f831ab1119e947349349703254595d
RemcosRAT
d113f72b9248e3a89d72d1238a8465af7857822b82951681cff22391ffff3039
RemcosRAT
e7a7b1d0ebf9cbb2760f3795b42b1b39596ab0eabf1cb12417ba2e8e42494708
RemcosRAT
error
RemcosRAT
+ 1'363 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost collection discovery execution rat
Link:
https://tria.ge/reports/260706-pvah4sa19n/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
Command and Scripting Interpreter: PowerShell
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Accesses Microsoft Outlook profiles
Badlisted process makes network request
Detected Nirsoft tools
NirSoft MailPassView
NirSoft WebBrowserPassView
Family: Remcos
Process spawned unexpected child process
Malware Config
C2 Extraction:
155.103.70.198:13408
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/75879d86cbcb3ece0ae2586a94c84cc867af39a799b9faa20e914eea8d9e323b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MalScript_Tricks
Create hunting rule
Author:@bartblaze
Description:Identifies tricks often seen in malicious scripts such as moving the window off-screen or resizing it to zero.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments