MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 75f0a13b548a29be733e8e7dcff844d4b2fc151aa01418b1ab0ed968c17aa040. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 75f0a13b548a29be733e8e7dcff844d4b2fc151aa01418b1ab0ed968c17aa040
SHA3-384 hash: 9b6333f3e06fa617cc3a7f40d6837c8243a7467ccf3ff0698c12874d302a049215e8e8ad76ec4cddf9b511509b0ac515
SHA1 hash: 4dcfa720d50f0ca0b5ab3a79184181ebb4d466c4
MD5 hash: 03aa29a77292f081ee247b798967687e
humanhash: green-bluebird-helium-freddie
File name:wegivemebestthingsbetterplaceforme.hta
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:13'028 bytes
First seen:2026-07-02 12:09:38 UTC
Last seen:Never
File type:HTML Application (hta) hta
MIME type:text/html
ssdeep 384:Fb/w5aEhEDxO+gu+EJOnKkeNJ1xW0j03PUsPAqpTg+w:F5EaJmp0jD
Threatray 1'371 similar samples on MalwareBazaar
TLSH T10442F4D8BA24168570FD9E0B158733DE37B0868301C794E3E39D4BBEAB1870625AF578
Magika html
Reporter James_inthe_box
Tags:exe hta RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
153
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.HTML.HideMe-22.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a4655457ebb079b692bbbc1
Tags:
virus ausiv sage
Result
Verdict:
Malicious
File Type:
HTA File - Malicious
Link:
https://app.docguard.net/75f0a13b548a29be733e8e7dcff844d4b2fc151aa01418b1ab0ed968c17aa040/results/dashboard
Payload URLs
URL
File name
https://blue-paper-f69f.acrypters.workers.dev/FTM0-40PO-AO28-G98E/img_u69eno.png
HTA File
Behaviour
BlacklistAPI detected
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm fingerprint powershell
Link:
https://www.filescan.io/uploads/6a465547e4a98a8922aa8fc3/reports/c7fe6b2d-a356-4719-8226-a191350c31f1/overview
Verdict:
Malicious
Labled as:
JS/LausivLoader.B trojan
Link:
https://www.hybrid-analysis.com/sample/75f0a13b548a29be733e8e7dcff844d4b2fc151aa01418b1ab0ed968c17aa040
Verdict:
Malicious
File Type:
hta
First seen:
2026-07-01T23:57:00Z UTC
Last seen:
2026-07-03T19:49:00Z UTC
Hits:
~10
Detections:
Trojan.JS.SAgent.sb HEUR:Trojan.Script.Generic
Link:
https://opentip.kaspersky.com/75f0a13b548a29be733e8e7dcff844d4b2fc151aa01418b1ab0ed968c17aa040/results?tab=lookup
Score:
87%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/75f0a13b548a29be733e8e7dcff844d4b2fc151aa01418b1ab0ed968c17aa040
Verdict:
inconclusive
YARA:
2 match(es)
Tags:
Html
Link:
https://app.malva.re/file/03aa29a77292f081ee247b798967687e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/75f0a13b548a29be733e8e7dcff844d4b2fc151aa01418b1ab0ed968c17aa040/
Verdict:
Malicious
Threat:
Trojan.JS.SAgent
Link:
https://tip.neiki.dev/file/75f0a13b548a29be733e8e7dcff844d4b2fc151aa01418b1ab0ed968c17aa040
Threat name:
Document-HTML.Trojan.Kepavll
Create hunting rule
Status:
Malicious
First seen:
2026-07-02 03:28:31 UTC
File Type:
Text (HTML)
Extracted files:
1
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oxykco2uriu344z6rz6476ce2szpyfi2uakbrmnlb3mwrql2ubaa._file
Verdict:
malicious
Label(s):
admintool_mailpassview
Create hunting rule
nirsoft
Create hunting rule
remcos
Create hunting rule
Similar samples:
40c57fa42423325baf7c646e4c135942c28495cdfa2b8ccec3455dc341013ef7
RemcosRAT
51a915c8b96fdba9947eb213342bae13ec23863f80cc0926c75a8546d1183eb6
RemcosRAT
82521f120291f02708e3787da16dbcecde8d8c93f81fae2745bc5d7d0fb0df62
RemcosRAT
8ba912704a7e4f686d5f29c0277b52fbfdeb1d1708bab9c6d0e06eb48f8dc539
RemcosRAT
adac9865fbb10c53cae9f3d670bf07270274d7f0ba7732a115c4e46f73c48d09
RemcosRAT
bd508ca26a1917807c4daba2f960be5243f831ab1119e947349349703254595d
RemcosRAT
d113f72b9248e3a89d72d1238a8465af7857822b82951681cff22391ffff3039
RemcosRAT
e7a7b1d0ebf9cbb2760f3795b42b1b39596ab0eabf1cb12417ba2e8e42494708
RemcosRAT
error
RemcosRAT
f5147495983f1e0eb0d595bcced8d5fceedfef286909fe6f213760c0742493ac
RemcosRAT
+ 1'361 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost collection discovery execution rat
Link:
https://tria.ge/reports/260702-pce1waf18p/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
outlook_office_path
Command and Scripting Interpreter: PowerShell
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Accesses Microsoft Outlook profiles
Badlisted process makes network request
Detected Nirsoft tools
NirSoft MailPassView
NirSoft WebBrowserPassView
Family: Remcos
Process spawned unexpected child process
Malware Config
C2 Extraction:
141.98.10.150:14641
141.98.10.150:14642
141.98.10.150:14643
141.98.10.150:14644
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/75f0a13b548a29be733e8e7dcff844d4b2fc151aa01418b1ab0ed968c17aa040

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MalScript_Tricks
Create hunting rule
Author:@bartblaze
Description:Identifies tricks often seen in malicious scripts such as moving the window off-screen or resizing it to zero.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments