MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 82f69d218791526f3724c1e6fcf7e73272182067c80f4d037557289863a241aa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	82f69d218791526f3724c1e6fcf7e73272182067c80f4d037557289863a241aa
SHA3-384 hash:	8e74add1d2c26876a11cfdfc723ab26928425acfe3226e086e4606e53caa72b013cbd9279710c3e4d75cb64f2ed4a666
SHA1 hash:	410c0850ec133e0c478c544cb5c2593f9f75fdf7
MD5 hash:	18393ab76eb3ce56c6ff89239ca7375f
humanhash:	twenty-vegan-one-red
File name:	asegurar.vbs
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	29'691'402 bytes
First seen:	2024-11-04 06:13:32 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	192:kyvvK6/OkFpbN0RwdU+0d0fntFwpWPINP:7iQOkc3eUQk
Threatray	20 similar samples on MalwareBazaar
TLSH	T1B85724F63FDEC0991818836668AF429DDAA3B205967D0EDB73C750878C5C1F27E91D82
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	mp3
Reporter	lontze7
Tags:	remcos RemcosRAT vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

4'231

Origin country :

FR

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=672866328d23d90491334a75

Tags:

powershell gumen

Hybrid Analysis GT:VB.Honolulu.1

Verdict:

Malicious

Labled as:

GT:VB.Honolulu.1

Link:

https://www.hybrid-analysis.com/sample/82f69d218791526f3724c1e6fcf7e73272182067c80f4d037557289863a241aa

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1548205

Signature

AI detected suspicious sample

Connects to a pastebin service (likely for C&C)

Encrypted powershell cmdline option found

Found suspicious powershell code related to unpacking or dynamic code loading

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Potential dropper URLs found in powershell memory

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

Uses ping.exe to check the status of other devices and networks

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Yara detected Generic Downloader

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/82f69d218791526f3724c1e6fcf7e73272182067c80f4d037557289863a241aa

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win32.Trojan.Honolulu

Threat name:

Win32.Trojan.Honolulu

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-11-04 06:14:08 UTC

File Type:

Text (VBS)

AV detection:

7 of 38 (18.42%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ql3j2imhsfjg6nzeyhtpz57hgjzbqidhzahu2a3vk4ujqy5cigva._file

Threatray remcos

Verdict:

malicious

Label(s):

remcos

Alert

Create hunting rule

Similar samples:

34360bd7023f9f8a12d52f7078eaf8a13228589b057978c71d73afd8bfa9d8e6

RemcosRAT

3a07acb9e24dace059cea1a5c9c90f457e3c0d3e823805ae2fd0241d75917fc2

RemcosRAT

449cfb586898cdc0e432940983eca397fe1fb06d83bc87d51a8ee6a3f5eaa062

RemcosRAT

624b0c72580ea146170f18ce38bc4c7acbd7224920ba68131314bb874e9edcd2

RemcosRAT

7149a3ee7410f37670c28243c1bb307c6187a324ee565c2a27c012feee12399a

RemcosRAT

e7280cbccf49363aabe6572cf67b20f3c8d8c4fb32b1ed71e77be389e9201f13

RemcosRAT

error

RemcosRAT

+ 10 additional samples on MalwareBazaar

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos botnet:newst1 defense_evasion discovery execution rat

Link:

https://tria.ge/reports/241104-gzbmzawapb/

Behaviour

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Suspicious use of SetThreadContext

Legitimate hosting services abused for malware hosting/C2

Obfuscated Files or Information: Command Obfuscation

Checks computer location settings

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Remcos

Remcos family

Malware Config

C2 Extraction:

sostregd.duckdns.org:3000

Dropper Extraction:

https://pastebin.com/raw/J6uRjZrv

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/82f69d218791526f3724c1e6fcf7e73272182067c80f4d037557289863a241aa