MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b3f86d452648db802ae581f767e2d6916b1fd8140c10f05c06605a9f833da21c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b3f86d452648db802ae581f767e2d6916b1fd8140c10f05c06605a9f833da21c
SHA3-384 hash:	c9d7119a44c8f7e2abd4412d94c84af11771aa36b151b16570f62bd922a14146df477802c7098bab938ff9d0ac1a3eb7
SHA1 hash:	3db7f6cb2a3bff77b4af1b1f2c74f79e247f4966
MD5 hash:	a1e3295ad194834a7ec7de6d6a319508
humanhash:	green-lithium-arizona-oklahoma
File name:	bestbeautifulthingsentiretimebetterresultsgive.hta
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	1'944 bytes
First seen:	2025-03-21 14:16:34 UTC
Last seen:	Never
File type:	hta
MIME type:	text/html
ssdeep	24:hPgWw2dSAT8cohnU/6E6AD3eIBE3jVxhIcUZJBEpm9Lx5LnEypwyUfypz0pkMCO:tgNqSZlC6v8DiCHpNAiQbCO
Threatray	1'123 similar samples on MalwareBazaar
TLSH	T155412A695825485C097645A268FAD51EF4A403AB7D0E5C3C318FCC73AF3878F46EE2D9
Magika	vba
Reporter	abuse_ch
Tags:	hta RemcosRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

115

Origin country :

DE

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67dd74cc115e7b48b48f6b90

Tags:

obfuscate remcos xtreme shell

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/b3f86d452648db802ae581f767e2d6916b1fd8140c10f05c06605a9f833da21c/results/dashboard

Payload URLs

URL

File name

https://dpaste.com/5JP59Y6B7.txt

HTA File

Behaviour

BlacklistAPI detected

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

cmd evasive lolbin timeout wscript

Link:

https://www.filescan.io/uploads/67dd75045ca829f6732366ea/reports/e7101977-1c24-4b7b-b798-14b96b5e4fde/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/b3f86d452648db802ae581f767e2d6916b1fd8140c10f05c06605a9f833da21c

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

spre.troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1645245

Signature

Antivirus detection for URL or domain

Command shell drops VBS files

Connects to a pastebin service (likely for C&C)

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Legitimate Application Dropped Script

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

System process connects to network (likely due to code injection or exploit)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Yara detected Powershell decode and execute

Yara detected Powershell download and execute

Yara detected VBS Downloader Generic

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/b3f86d452648db802ae581f767e2d6916b1fd8140c10f05c06605a9f833da21c

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b3f86d452648db802ae581f767e2d6916b1fd8140c10f05c06605a9f833da21c/

ReversingLabs TitaniumCloud Script-WScript.Trojan.Remcos

Threat name:

Script-WScript.Trojan.Remcos

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-03-21 11:59:34 UTC

File Type:

Text (HTML)

Extracted files:

1

AV detection:

10 of 24 (41.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wp4g2rjgjdnyakxfqh3wpywwsfvr7waubqipaxagmbnj7az5uioa._file

Threatray admintool_mailpassview nirsoft remcos

Verdict:

malicious

Label(s):

admintool_mailpassview

Alert

Create hunting rule

nirsoft

Alert

Create hunting rule

remcos

Alert

Create hunting rule

Similar samples:

11d67ce2068437cce35f0b601119ebd071921f536daa8a5afff7c4d03ff1a4bc

RemcosRAT

1a8c4a357230c2b388cb9cc9171ab0bcc37a194fdf99e69e6a42d8e1a3d2652b

RemcosRAT

24af52ae7f3afb9533d3ad2e4a845bdc69dc96388d4b98853b8dd567174a43b2

RemcosRAT

27e9d8399b11830c69e45b1d2f37dbde869ff3ec1185ea640c209399fb1d737b

RemcosRAT

32f32787e8bbc5276d6f9d1d1d8b0f5f762b33df9abf8a820f34d6e702603b99

RemcosRAT

42b3442bc675f7ff95d660935ea8756710fea99551b1d614f2e8b7db739d72a0

RemcosRAT

9b9059af739b167db6afce5129997e489dbb7baa3af27c8da5a68d564c2ed84e

RemcosRAT

ad4a934328e699a5065c7c55ab3399d74134b5e97401175948b5296faf98d2a8

RemcosRAT

d2a87b1b1a1106b874e949e49a55e7e68202eaa84062c270bbf62481bb769a45

RemcosRAT

error

RemcosRAT

+ 1'113 additional samples on MalwareBazaar

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos botnet:remotehost collection discovery execution rat

Link:

https://tria.ge/reports/250321-rlvtsstr12/

Behaviour

Delays execution with timeout.exe

Modifies Internet Explorer settings

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook accounts

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Blocklisted process makes network request

Detected Nirsoft tools

NirSoft MailPassView

NirSoft WebBrowserPassView

Remcos

Remcos family

Malware Config

C2 Extraction:

216.9.225.133:48905

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/b3f86d452648db802ae581f767e2d6916b1fd8140c10f05c06605a9f833da21c