MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bbe818541c34a4def85455fa7a1392d2ded1e76ca6d89f08125a13d09ea4b93a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	bbe818541c34a4def85455fa7a1392d2ded1e76ca6d89f08125a13d09ea4b93a
SHA3-384 hash:	721f7ad07a2811f3205959da3ac4dfacab21bdcf066c70e67a99590c386a3bd5dd93d865c61ebc199448b55473521ff7
SHA1 hash:	0b56d72ecb891950f8b4e8bf7288aee0ac102101
MD5 hash:	ece58ed90bef5251133c688f6afe915f
humanhash:	fourteen-colorado-july-delta
File name:	c2.hta
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	3'411 bytes
First seen:	2025-01-05 02:01:55 UTC
Last seen:	2025-01-07 09:13:04 UTC
File type:	hta
MIME type:	text/html
ssdeep	48:uOZ+wfT1tHcmhdT1hnLU5Lo1fWKGcBF50H3/CO:uAr1JhV1hL6/LAQH3
TLSH	T1A661C01FDE939F628932CA23086BA80DDD9DC50F15508489750CCC4A7F7537CA8D06FA
Magika	vba
Reporter	abuse_ch
Tags:	hta myguyapp-com RemcosRAT

Intelligence

---

File Origin

# of uploads :

5

# of downloads :

125

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan-Downloader.HTML.Adodb.7527.9744.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6779e9181ada70779827e326

Tags:

trojandownloader virus html

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/bbe818541c34a4def85455fa7a1392d2ded1e76ca6d89f08125a13d09ea4b93a/results/dashboard

Payload URLs

URL

File name

https://myguyapp.com/c2.bat

HTA File

Behaviour

BlacklistAPI detected

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/677a2d4dfdb52c80bac0101d/reports/8f7a3371-d09c-449a-bd53-548f13cb5e63/overview

Hybrid Analysis PowerShell/Agent.AOR trojan

Verdict:

Suspicious

Labled as:

PowerShell/Agent.AOR trojan

Link:

https://www.hybrid-analysis.com/sample/bbe818541c34a4def85455fa7a1392d2ded1e76ca6d89f08125a13d09ea4b93a

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Joe Sandbox Remcos

Result

Threat name:

Remcos

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1584279

Signature

AI detected suspicious sample

Antivirus detection for URL or domain

Detected Remcos RAT

Drops large PE files

Drops PE files with a suspicious file extension

Found API chain indicative of sandbox detection

Installs a global keyboard hook

Loading BitLocker PowerShell Module

Powershell drops PE file

Sigma detected: Drops script at startup location

Sigma detected: Legitimate Application Dropped Script

Sigma detected: Remcos

Sigma detected: Search for Antivirus process

Sigma detected: Suspicious Command Patterns In Scheduled Task Creation

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious powershell command line found

Uses schtasks.exe or at.exe to add and modify task schedules

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript called in batch mode (surpress errors)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/bbe818541c34a4def85455fa7a1392d2ded1e76ca6d89f08125a13d09ea4b93a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bbe818541c34a4def85455fa7a1392d2ded1e76ca6d89f08125a13d09ea4b93a/

ReversingLabs TitaniumCloud Document-HTML.Downloader.Remcos

Threat name:

Document-HTML.Downloader.Remcos

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-01-05 03:01:10 UTC

AV detection:

8 of 23 (34.78%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xpubqva4gssn56cukx5hue4s2lpndz3mu3mj6caslij5bhvexe5a._file

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos botnet:2024 discovery execution rat

Link:

https://tria.ge/reports/250105-cf4r7azlaj/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Modifies Internet Explorer settings

Modifies registry class

Modifies system certificate store

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Windows directory

Enumerates processes with tasklist

Checks computer location settings

Drops startup file

Executes dropped EXE

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Remcos

Remcos family

Suspicious use of NtCreateUserProcessOtherParentProcess

Malware Config

C2 Extraction:

me-work.com:7009

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/bbe818541c34a4def85455fa7a1392d2ded1e76ca6d89f08125a13d09ea4b93a