MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 98a871afbf1f908f798a5d354a959e06252b8e0f13adb679bca7a04dddb031df. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 98a871afbf1f908f798a5d354a959e06252b8e0f13adb679bca7a04dddb031df
SHA3-384 hash: 5fa963da42f939a1ee8a0c90da5bfd2914ae81103c18ec57b89420745a5b4a8a1eb46a476b85b80d1d40e23bb2561c06
SHA1 hash: c7d28f4477041cc6997fc7d055fc724fc7f5dafa
MD5 hash: 63bd99d4ce2e11852e71ba2058f8d6e3
humanhash: fruit-tennis-zebra-lake
File name:goingbestplacecomingforbetterwaysinthelifegoodformebest.hta
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:28'465 bytes
First seen:2026-07-16 12:23:41 UTC
Last seen:Never
File type:HTML Application (hta) hta
MIME type:text/plain
ssdeep 96:QTp/UYBGZTjKhp5kg+w6V7Sulxg4BYhWNWeoKE27IRfdtmmTBN:Ip364BeoZdt/TH
TLSH T172D2B5BE52722C4EE612700FD949EDB088E9073B25625B2E62F9558D014D74EB0D3EBB
Magika javascript
Reporter James_inthe_box
Tags:exe hta RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
170
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.HTML.HideMe-22.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a58d14a56bd89099b557176
Tags:
n/a
Result
Verdict:
Malicious
File Type:
HTA File - Malicious
Link:
https://app.docguard.net/98a871afbf1f908f798a5d354a959e06252b8e0f13adb679bca7a04dddb031df/results/dashboard
Payload URLs
URL
File name
https://nameless-scene-7204.uploadeeeesclientess.workers.dev/FTM0-40PO-AO28-G98E/img_b0utd5.png
HTA File
Behaviour
BlacklistAPI detected
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm fingerprint powershell
Link:
https://www.filescan.io/uploads/6a58d141c182b396bc3879c5/reports/62ef02c1-9c1b-4acf-90cd-10bb8daf190d/overview
Verdict:
Malicious
Labled as:
Trojan/JS.Obfuscated
Link:
https://www.hybrid-analysis.com/sample/98a871afbf1f908f798a5d354a959e06252b8e0f13adb679bca7a04dddb031df
Verdict:
Malicious
File Type:
hta
First seen:
2026-07-16T07:36:00Z UTC
Last seen:
2026-07-18T10:15:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/98a871afbf1f908f798a5d354a959e06252b8e0f13adb679bca7a04dddb031df/results?tab=lookup
Score:
18%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/98a871afbf1f908f798a5d354a959e06252b8e0f13adb679bca7a04dddb031df
Verdict:
inconclusive
YARA:
2 match(es)
Tags:
Html
Link:
https://app.malva.re/file/63bd99d4ce2e11852e71ba2058f8d6e3
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/98a871afbf1f908f798a5d354a959e06252b8e0f13adb679bca7a04dddb031df/
Threat name:
Win32.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-07-16 12:24:05 UTC
File Type:
Text (HTML)
Extracted files:
1
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tcuhdl57d6ii66mklu2uvfm6ayssxdqpcow3m6n4u6qe3xnqghpq._file
Verdict:
malicious
Label(s):
ADMINTOOL_MailPassView
Create hunting rule
NirSoft
Create hunting rule
Remcos
Create hunting rule
Similar samples:
40c57fa42423325baf7c646e4c135942c28495cdfa2b8ccec3455dc341013ef7
RemcosRAT
75f0a13b548a29be733e8e7dcff844d4b2fc151aa01418b1ab0ed968c17aa040
RemcosRAT
82521f120291f02708e3787da16dbcecde8d8c93f81fae2745bc5d7d0fb0df62
RemcosRAT
ba8f9811ebb5944c39e09d2bd9351e0bf8ec305774e41edd5a49d9d3d3580ef9
RemcosRAT
bd508ca26a1917807c4daba2f960be5243f831ab1119e947349349703254595d
RemcosRAT
c73c47b85140212238b5fa19dd5753ac0962c03df4c2bb4afbf25e43c23a2d0b
RemcosRAT
d503c1d9574deb89855643ab0d1063bc28331cc3a580fe7286a56bfc8b09afc8
RemcosRAT
e7a7b1d0ebf9cbb2760f3795b42b1b39596ab0eabf1cb12417ba2e8e42494708
RemcosRAT
error
RemcosRAT
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:goldeneye collection discovery execution rat
Link:
https://tria.ge/reports/260716-pwgntahw2s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
Command and Scripting Interpreter: PowerShell
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Accesses Microsoft Outlook profiles
Badlisted process makes network request
Detected Nirsoft tools
NirSoft MailPassView
NirSoft WebBrowserPassView
Family: Remcos
Process spawned unexpected child process
Malware Config
C2 Extraction:
141.98.10.150:14642
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/98a871afbf1f908f798a5d354a959e06252b8e0f13adb679bca7a04dddb031df

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MalScript_Tricks
Create hunting rule
Author:@bartblaze
Description:Identifies tricks often seen in malicious scripts such as moving the window off-screen or resizing it to zero.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments