MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9b644fcaed6386b1256248258a1946248d29e72949ba28bdc279f5f326f81a3b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9b644fcaed6386b1256248258a1946248d29e72949ba28bdc279f5f326f81a3b
SHA3-384 hash: 053dc4d35c32195bf41bb86c45dd3b4701798e5064d06d477b75a1f88f482cf0a387fd1c67b1b993106ffc55f5536ed4
SHA1 hash: d006775a792bd1d5a3fc6bd1d599c6e2605bc94e
MD5 hash: e82133811ae4af350b55d071c8086e63
humanhash: seventeen-tennessee-aspen-fanta
File name:verygoodmorningwithgoodgracenicgoodfor.hta
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:4'674 bytes
First seen:2025-05-17 17:13:26 UTC
Last seen:Never
File type:HTML Application (hta) hta
MIME type:text/html
ssdeep 96:/mD0wB6OBFxF4UcD0pZ1ZlHI8R3SCooGKvR0oV4spVjGzc9:/XgtFRu0pZ1ZlHI8dSCdGyR0oV4eVjGY
TLSH T188A113C2D301FAABCDB2767D7A35BF2450212E36DDBDD1623916320948E435882D26CF
Magika html
Reporter abuse_ch
Tags:hta RemcosRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.JS.Starter.96.6774.2623.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6828d6a6e5aa44ec2e1a4333
Tags:
xtreme shell sage
Result
Verdict:
Clean
File Type:
HTA File
Link:
https://app.docguard.net/9b644fcaed6386b1256248258a1946248d29e72949ba28bdc279f5f326f81a3b/results/dashboard
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade timeout
Link:
https://www.filescan.io/uploads/6828c3e2c609634bd7c7079a/reports/c6ee2570-6148-41a1-8bbb-3eec66a0ca09/overview
Verdict:
Malicious
Labled as:
TrojanDownloader/JS.NetLoader
Link:
https://www.hybrid-analysis.com/sample/9b644fcaed6386b1256248258a1946248d29e72949ba28bdc279f5f326f81a3b
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
rans.spre.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1693021
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Command shell drops VBS files
Connects to a pastebin service (likely for C&C)
Contains functionality to bypass UAC (CMSTPLUA)
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Delayed program exit found
Detected Remcos RAT
Found malware configuration
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Potential malicious VBS script found (suspicious strings)
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Legitimate Application Dropped Script
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Remcos
Sigma detected: Script Initiated Connection to Non-Local Network
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
System process connects to network (likely due to code injection or exploit)
Uses dynamic DNS services
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Yara detected AntiVM3
Yara detected Powershell decode and execute
Yara detected Powershell download and execute
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
Yara detected VBS Downloader Generic
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1693021 Sample: verygoodmorningwithgoodgrac... Startdate: 17/05/2025 Architecture: WINDOWS Score: 100 41 newjourneynewstartfreshthingforfuture.duckdns.org 2->41 43 paste.ee 2->43 45 4 other IPs or domains 2->45 69 Suricata IDS alerts for network traffic 2->69 71 Found malware configuration 2->71 73 Malicious sample detected (through community Yara rule) 2->73 79 19 other signatures 2->79 10 mshta.exe 2 2->10         started        13 svchost.exe 1 1 2->13         started        signatures3 75 Uses dynamic DNS services 41->75 77 Connects to a pastebin service (likely for C&C) 43->77 process4 dnsIp5 39 C:\Windows\Temp\cashaw.bat, DOS 10->39 dropped 16 cmd.exe 2 10->16         started        53 127.0.0.1 unknown unknown 13->53 file6 process7 file8 37 C:\Windows\Temp\Chardzhou.vbs, ASCII 16->37 dropped 65 Potential malicious VBS script found (suspicious strings) 16->65 67 Command shell drops VBS files 16->67 20 wscript.exe 1 16->20         started        24 conhost.exe 16->24         started        26 timeout.exe 1 16->26         started        signatures9 process10 dnsIp11 47 paste.ee 23.186.113.60, 443, 49710, 49711 KLAYER-GLOBALNL Reserved 20->47 81 System process connects to network (likely due to code injection or exploit) 20->81 83 Suspicious powershell command line found 20->83 85 Wscript starts Powershell (via cmd or directly) 20->85 87 2 other signatures 20->87 28 powershell.exe 15 15 20->28         started        signatures12 process13 dnsIp14 49 209.54.102.173, 49716, 80 ASN-QUADRANET-GLOBALUS United States 28->49 51 192.3.243.172, 49712, 80 AS-COLOCROSSINGUS United States 28->51 31 MSBuild.exe 4 28->31         started        35 conhost.exe 28->35         started        process15 dnsIp16 55 newjourneynewstartfreshthingforfuture.duckdns.org 192.169.69.26, 14645, 49724, 49725 WOWUS United States 31->55 57 Contains functionality to bypass UAC (CMSTPLUA) 31->57 59 Detected Remcos RAT 31->59 61 Contains functionalty to change the wallpaper 31->61 63 4 other signatures 31->63 signatures17
Score:
47%
Verdict:
Susipicious
File Type:
SCRIPT
Link:
https://malprob.io/report/9b644fcaed6386b1256248258a1946248d29e72949ba28bdc279f5f326f81a3b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9b644fcaed6386b1256248258a1946248d29e72949ba28bdc279f5f326f81a3b/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-05-17 17:26:50 UTC
File Type:
Text (JavaScript)
AV detection:
7 of 24 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tnse7sxnmodlcjlcjasyugkgesgstzzjjg5crpocph27gjxydi5q._file
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:zyno discovery execution rat
Link:
https://tria.ge/reports/250517-w7tk3sypv6/
Behaviour
Delays execution with timeout.exe
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Blocklisted process makes network request
Command and Scripting Interpreter: PowerShell
Remcos
Remcos family
Malware Config
C2 Extraction:
newjourneynewstartfreshthingforfuture.duckdns.org:14645
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9b644fcaed63/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9b644fcaed6386b1256248258a1946248d29e72949ba28bdc279f5f326f81a3b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RemcosRAT

HTML Application (hta) hta 9b644fcaed6386b1256248258a1946248d29e72949ba28bdc279f5f326f81a3b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3545186/
  
Delivery method
Distributed via web download

Comments