MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b348772a94c8dacb5019a6f3f8a419dfd815ab0a075107a2d41ca02d0b69eb73. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b348772a94c8dacb5019a6f3f8a419dfd815ab0a075107a2d41ca02d0b69eb73
SHA3-384 hash:	2b8c4bd2ea2f154e3b5dfeb32344fe0644c7bec2ddf5460c257b9c5380f4e24c7a61e620bc6a0f8e8e2d688f6a9a01f9
SHA1 hash:	8ae92eca58fd2d610e9fae9120da42ae81d952ec
MD5 hash:	c4c2d481c6dfc01c4e0cd25bc98a1187
humanhash:	venus-massachusetts-november-salami
File name:	givenmebestthingswithgreatthings.hta
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	3'395 bytes
First seen:	2025-06-24 15:47:41 UTC
Last seen:	2025-06-27 13:01:36 UTC
File type:	hta
MIME type:	text/html
ssdeep	24:jETAenvIBkMQv2rSG/vLR3Q/8xDLqWO0VlnNxOOhQ3i7YVXEMrVP7Pxyyw1HB++i:4JIXWiSYzdnxDLqOPdQyEBEMNzA93Y2Q
Threatray	1'116 similar samples on MalwareBazaar
TLSH	T1D661055D393148BCCB28856BE85AF55AD2609E93F0486C30D49C5811AF81D8DE58CFCD
Magika	txt
Reporter	abuse_ch
Tags:	hta newstartnewjournyevamygirllovesalotwithm-duckdns-org RemcosRAT

Intelligence

---

File Origin

# of uploads :

4

# of downloads :

69

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Agent-9.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.JS.Obfus-95.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=685ac8d632ed47a3a8d6be4e

Tags:

n/a

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/b348772a94c8dacb5019a6f3f8a419dfd815ab0a075107a2d41ca02d0b69eb73/results/dashboard

Behaviour

BlacklistAPI detected

Hybrid Analysis VBS/Agent.BYV

Verdict:

Suspicious

Labled as:

VBS/Agent.BYV

Link:

https://www.hybrid-analysis.com/sample/b348772a94c8dacb5019a6f3f8a419dfd815ab0a075107a2d41ca02d0b69eb73

Joe Sandbox HTMLPhisher

Result

Threat name:

HTMLPhisher

Alert

Create hunting rule

Detection:

malicious

Classification:

spre.phis.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1722026

Signature

Command shell drops VBS files

Multi AV Scanner detection for submitted file

Potential malicious VBS script found (suspicious strings)

Sigma detected: Legitimate Application Dropped Script

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

System process connects to network (likely due to code injection or exploit)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Yara detected HtmlPhish44

Yara detected VBS Downloader Generic

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

1%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/b348772a94c8dacb5019a6f3f8a419dfd815ab0a075107a2d41ca02d0b69eb73

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

2 match(es)

Tags:

Html

Link:

https://app.malva.re/file/c4c2d481c6dfc01c4e0cd25bc98a1187

CERT.PL MWDB remcos

Detection:

remcos

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/b348772a94c8dacb5019a6f3f8a419dfd815ab0a075107a2d41ca02d0b69eb73/

Neiki Malicious

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/b348772a94c8dacb5019a6f3f8a419dfd815ab0a075107a2d41ca02d0b69eb73

ReversingLabs TitaniumCloud Script-WScript.Trojan.Heuristic

Threat name:

Script-WScript.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-06-24 05:49:06 UTC

File Type:

Text (HTML)

Extracted files:

1

AV detection:

9 of 24 (37.50%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wnehokuuzdnmwuazu3z7rjaz37mblkyka5iqpiwudsqc2c3j5nzq._file

Threatray remcos

Verdict:

malicious

Label(s):

remcos

Alert

Create hunting rule

Similar samples:

1311aed7b08093746c808edea41d40fb2e8547a1bd86a2516cf7bf4f1f2075fd

RemcosRAT

16792778b324bb4cd13bf84064b492ac9889ef809ccb5d2dfde7fae3df246787

RemcosRAT

1c80bf8e780ae58203e7f816c8fe04f66df434a3fbd981ba7c6e52e588622c03

RemcosRAT

1f0573e1fd20ac052c3593942274cb9c892c3dba6766ddc5ccb557a01ffd5d97

RemcosRAT

2c3f31c3ee37440e580e755960537e13511027a95e9539da15c3984a8a20be9f

RemcosRAT

6cef2a9dfe5e84b67c901ff1e8d8544ed3f763b47a462f9014f3674db182e464

RemcosRAT

6d0bd45ec3207831c1353180e2035b4247546d7e463e396d54ee66760621397c

RemcosRAT

9028bd4ea1a87f165f5d1d0532485fad2a3df80686135985cfac70d3ca54c1f5

RemcosRAT

dd95e35cfef21255b4e103c4fded9e6dbf9c8f45d52884397d93355355f62c6c

RemcosRAT

error

RemcosRAT

+ 1'106 additional samples on MalwareBazaar

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos botnet:evangle collection discovery execution rat

Link:

https://tria.ge/reports/250624-s8wkaav1ev/

Behaviour

Delays execution with timeout.exe

Script User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook accounts

Checks computer location settings

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Detected Nirsoft tools

NirSoft MailPassView

NirSoft WebBrowserPassView

Remcos

Remcos family

Malware Config

C2 Extraction:

newstartnewjournyevamygirllovesalotwithm.duckdns.org:14646

Dropper Extraction:

http://149.154.158.50/xampp/cb/wp4096799-lost-in-space-wallpapers.jpg

VMRay Remcos

Malware family:

Remcos

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/b348772a94c8/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b348772a94c8dacb5019a6f3f8a419dfd815ab0a075107a2d41ca02d0b69eb73