MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8da5bb4d9cfd29718720e839bb75ee58f92b6e41f0181b6eede4234d3122dab6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	8da5bb4d9cfd29718720e839bb75ee58f92b6e41f0181b6eede4234d3122dab6
SHA3-384 hash:	764ab61e0813820d5a8abc514d1878a25f51c2bf618549681a95755282aa519cd6ce3febce102df5ea55534284d6de2e
SHA1 hash:	ceb81e97c94c5655d1743114044f505184ddead2
MD5 hash:	4fadf00aa57b7ca6bcb6b02cb338c0b2
humanhash:	uniform-autumn-hydrogen-blue
File name:	c.hta
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	1'224 bytes
First seen:	2025-01-12 03:17:17 UTC
Last seen:	Never
File type:	hta
MIME type:	text/html
ssdeep	24:I5ATsWh2cpwg5ilnOH9qQI0gj+ILhH/8JoMCO:GOhh2g5i5OdqQI0g7dH/w/CO
TLSH	T160212D2BF86FC878957A84E214AADC48F68903134388A88B705C10A36F7E38B42C20DD
Magika	vba
Reporter	abuse_ch
Tags:	hta RemcosRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

147

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.JS.Obfus-745.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6783346c2c8240e189bbfe2a

Tags:

xtreme shell sage

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/8da5bb4d9cfd29718720e839bb75ee58f92b6e41f0181b6eede4234d3122dab6/results/dashboard

Payload URLs

URL

File name

https://candwfarmsllc.com/c2.bat';

HTA File

Behaviour

BlacklistAPI detected

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6783347f7c7460158e6b1ed0/reports/3982625c-aa70-46fb-b2df-898a756c3d00/overview

Hybrid Analysis GT:VB.ObfDldr.32

Verdict:

Malicious

Labled as:

GT:VB.ObfDldr.32

Link:

https://www.hybrid-analysis.com/sample/8da5bb4d9cfd29718720e839bb75ee58f92b6e41f0181b6eede4234d3122dab6

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox Remcos

Result

Threat name:

Remcos

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1589383

Signature

AI detected suspicious sample

Antivirus detection for URL or domain

Detected Remcos RAT

Drops large PE files

Drops PE files with a suspicious file extension

Found API chain indicative of sandbox detection

Installs a global keyboard hook

Loading BitLocker PowerShell Module

Multi AV Scanner detection for dropped file

Powershell drops PE file

Sigma detected: Drops script at startup location

Sigma detected: HackTool - CACTUSTORCH Remote Thread Creation

Sigma detected: Powerup Write Hijack DLL

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Sigma detected: Remcos

Sigma detected: Search for Antivirus process

Sigma detected: Suspicious Command Patterns In Scheduled Task Creation

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious powershell command line found

Uses schtasks.exe or at.exe to add and modify task schedules

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript called in batch mode (surpress errors)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/8da5bb4d9cfd29718720e839bb75ee58f92b6e41f0181b6eede4234d3122dab6

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Document-HTML.Trojan.Heuristic

Threat name:

Document-HTML.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-01-12 03:27:08 UTC

File Type:

Text (HTML)

Extracted files:

1

AV detection:

8 of 24 (33.33%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rws3wtm47uuxdbza5a43w5pold4sw3sb6ambw3xn4qru2mjc3k3a._file

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos botnet:remotehost discovery execution rat

Link:

https://tria.ge/reports/250112-dtsshstney/

Behaviour

Checks processor information in registry

Modifies Internet Explorer settings

Modifies registry class

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Windows directory

Enumerates processes with tasklist

Checks computer location settings

Drops startup file

Executes dropped EXE

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Remcos

Remcos family

Suspicious use of NtCreateUserProcessOtherParentProcess

Malware Config

C2 Extraction:

me-work.com:7009

Dropper Extraction:

https://candwfarmsllc.com/c2.bat

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/8da5bb4d9cfd29718720e839bb75ee58f92b6e41f0181b6eede4234d3122dab6