MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca5a213e123d830ad88e6eb9da341326fa6ea6c5bb535069406f9454b5aecccc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ca5a213e123d830ad88e6eb9da341326fa6ea6c5bb535069406f9454b5aecccc
SHA3-384 hash:	0876d90d2e59ef2f7aea6b141b8d1aa30812f0261786af32f48947c903a59ff31fe5488249fbcd275e46c15af6a96920
SHA1 hash:	570e38194e3d5e977af449ca2fe1ef9f05b9c7de
MD5 hash:	709df3d382b86fffeda0e0c534206ec1
humanhash:	cold-harry-chicken-white
File name:	AMERICAN GROUP.js
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	6'036 bytes
First seen:	2024-09-07 17:36:07 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	96:XHSZyZ020gtthyohPx1MMEqzHQH0TqfpkIiup77jIf:i/dyU4I370
TLSH	T16AC1CA1CBFD7011D72729A95F9FA40D3A8363BDA7905DB4E00D283DE057390EA8A5E2D
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	mp3
Reporter	JAMESWT_WT
Tags:	closen-kozow-com js remcos RemcosRAT Spam-ITA teste iluminati

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

453

Origin country :

IT

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Obfus-101.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.JS.Obfus-2314.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.PUA.JS.Obfus-2179.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.PUA.JS.Obfus-2525.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

90.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66dc8f073236667691a1f698

Tags:

Network Stealth

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

71%

Link:

https://www.filescan.io/uploads/66dc8f3ef388891e55a18b49/reports/152a9a4c-a79a-4657-b308-44ef86ecfa32/overview

Hybrid Analysis PowerShell/TrojanDownloader.Agent

Verdict:

Malicious

Labled as:

PowerShell/TrojanDownloader.Agent

Link:

https://www.hybrid-analysis.com/sample/ca5a213e123d830ad88e6eb9da341326fa6ea6c5bb535069406f9454b5aecccc

Joe Sandbox Remcos

Result

Threat name:

Remcos

Alert

Create hunting rule

Detection:

malicious

Classification:

rans.phis.troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1506337

Behaviour

Behavior Graph:

n/a

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/ca5a213e123d830ad88e6eb9da341326fa6ea6c5bb535069406f9454b5aecccc

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ca5a213e123d830ad88e6eb9da341326fa6ea6c5bb535069406f9454b5aecccc/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zjnccpqshwbqvweon245unate35g5jwfxnjva2kan6kfjnnoztga._file

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos botnet:ezeife collection credential_access discovery execution rat spyware stealer

Link:

https://tria.ge/reports/240907-v65fhswbkm/

Behaviour

Script User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook accounts

Command and Scripting Interpreter: PowerShell

Legitimate hosting services abused for malware hosting/C2

Checks computer location settings

Drops startup file

Reads user/profile data of web browsers

Blocklisted process makes network request

Credentials from Password Stores: Credentials from Web Browsers

Detected Nirsoft tools

NirSoft MailPassView

NirSoft WebBrowserPassView

Remcos

Malware Config

C2 Extraction:

closen.kozow.com:2404

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Remcos

Threat name:

Remcos

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/ca5a213e123d830ad88e6eb9da341326fa6ea6c5bb535069406f9454b5aecccc