MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 beda570aa022ae2a08a2e3647fd50c60cfb1f8827568b2bba669bbac3161bf49. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	beda570aa022ae2a08a2e3647fd50c60cfb1f8827568b2bba669bbac3161bf49
SHA3-384 hash:	23f238a5fc7d8dea8fa23c387aa9cd1ddf48b9c6c5960a708c949b9033ff3393aba33fd8cd240b6b4658191d996cc93f
SHA1 hash:	b7c46664fa116ee19330496fa3f6fc59222de57c
MD5 hash:	492e65ee49037a08dbb1d3a48cb818c0
humanhash:	enemy-venus-bacon-low
File name:	image_03949595959.jpg.hta
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	15'465 bytes
First seen:	2026-09-29 08:24:38 UTC
Last seen:	Never
File type:	hta
MIME type:	text/html
ssdeep	192:iauUmLLHvCh9sq+FE3a+RLVjw/RqWv6o/weu5PO3UwRAQHBOv5ehc2m7YBNNKhf:/u7L5F60xSqw6nOxhdyCf
TLSH	T12162D5AC633BBCC490A769B1595A703D911149A2CF418AE6B3E4DFFD0EFD2604273A5C
Magika	txt
Reporter	abuse_ch
Tags:	hta RemcosRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

78

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Agent.AKR.tr.16204.22675.UNOFFICIAL

Alert

Create hunting rule

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/beda570aa022ae2a08a2e3647fd50c60cfb1f8827568b2bba669bbac3161bf49/results/dashboard

Behaviour

BlacklistAPI detected

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 masquerade obfuscated powershell.exe

Link:

https://www.filescan.io/uploads/6abb75f252187f0832bbf4b9/reports/650e5946-b074-45ae-82bf-f5c77429f62f/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/beda570aa022ae2a08a2e3647fd50c60cfb1f8827568b2bba669bbac3161bf49

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

hta

First seen:

2026-09-29T04:09:00Z UTC

Last seen:

2026-09-30T08:29:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/beda570aa022ae2a08a2e3647fd50c60cfb1f8827568b2bba669bbac3161bf49/results?tab=lookup

Joe Sandbox Remcos

Result

Threat name:

Remcos

Alert

Create hunting rule

Detection:

malicious

Classification:

rans.troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1979340

Signature

C2 URLs / IPs found in malware configuration

Contains functionality to bypass UAC (CMSTPLUA)

Contains functionality to register a low level keyboard hook

Contains functionality to steal Internet Explorer form passwords

Contains functionalty to change the wallpaper

Detected Remcos RAT

Found malware configuration

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: MSHTA Suspicious Execution 01

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Remcos

Sigma detected: Suspicious MSHTA Child Process

Suricata IDS alerts for network traffic

Suspicious command line found

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Unusual module load detection (module proxying)

Uses known network protocols on non-standard ports

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

96%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/beda570aa022ae2a08a2e3647fd50c60cfb1f8827568b2bba669bbac3161bf49

Malva.RE Malware

Verdict:

Malware

YARA:

3 match(es)

Tags:

Batch Command COM Behavior Trace DeObfuscated Html Obfuscated PowerShell PowerShell Call SOS: 0.25 T1027 T1059 T1059.001 T1059.005 VBScript WScript.Shell

Link:

https://app.malva.re/file/492e65ee49037a08dbb1d3a48cb818c0

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/beda570aa022ae2a08a2e3647fd50c60cfb1f8827568b2bba669bbac3161bf49/

ReversingLabs TitaniumCloud Script-WScript.Packed.Generic

Threat name:

Script-WScript.Packed.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-09-29 07:39:35 UTC

File Type:

Text (HTML)

Extracted files:

1

AV detection:

6 of 24 (25.00%)

Threat level:

  1/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=x3nfocvaekxcucfc4nsh7vimmdh3d6ecovulfo5gng52ymlbx5eq._file

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos botnet:mkv v1 1new collection defense_evasion discovery execution rat

Link:

https://tria.ge/reports/260929-kbew9sxv5q/

Behaviour

Kills process with taskkill

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

Enumerates physical storage devices

Executes a command shell one-liner

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Enumerates connected drives

Checks computer location settings

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Family: Remcos

Malware Config

C2 Extraction:

38.9.96.236:2707

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/beda570aa022ae2a08a2e3647fd50c60cfb1f8827568b2bba669bbac3161bf49