MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd357092187e69c962d4c33384d68a77b3f044d0583239267537288629f883da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	cd357092187e69c962d4c33384d68a77b3f044d0583239267537288629f883da
SHA3-384 hash:	c3cee99f32ab7b71a7bdf03b1fe09229088812724186fc649c718abded8471e829f9004f24d77b14d08d60d4cecfe897
SHA1 hash:	d507044a072801cd9ce73619f8a43647d0f465ea
MD5 hash:	0eea6ce45e121ed22b89a006b3a4c1c3
humanhash:	tennis-utah-ohio-indigo
File name:	envio.js
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	926 bytes
First seen:	2024-06-05 07:25:13 UTC
Last seen:	2024-09-26 04:52:44 UTC
File type:	js
MIME type:	text/plain
ssdeep	24:NU+nqkq/hmDImM42l/5Wmt6kvOCCJd5mKW8WtR6A:WCqBmDImMTRWmtllCT5mKWZSA
TLSH	T1C1118C8C00BFC56F58955D4E0A00D28D1DE2CD112E32B655B32EB4DB1E8C39D0BC957C
Reporter	lontze7
Tags:	js remcos RemcosRAT

lontze7

Downloaded from http://191.98.25.251/envio.js.

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

418

Origin country :

GR

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.JS.Generic-AE.10643.29438.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.JS.Generic-AE.24829.6111.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6660379731703c6eb9054754win7simulatehigh_evasion

Tags:

Banker Encryption Execution Network Stealth Dexter

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

obfuscated powershell

Link:

https://www.filescan.io/uploads/6660130bea679c2da917cf24/reports/c2ff9bf7-13ee-46a1-b6f3-039720f7af8b/overview

Hybrid Analysis JS/TrojanDownloader.Agent

Verdict:

Malicious

Labled as:

JS/TrojanDownloader.Agent

Link:

https://www.hybrid-analysis.com/sample/cd357092187e69c962d4c33384d68a77b3f044d0583239267537288629f883da

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1452202

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

JavaScript source code contains functionality to generate code involving a shell, file or stream

JScript performs obfuscated calls to suspicious functions

Loading BitLocker PowerShell Module

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Powershell uses Background Intelligent Transfer Service (BITS)

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/cd357092187e69c962d4c33384d68a77b3f044d0583239267537288629f883da

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cd357092187e69c962d4c33384d68a77b3f044d0583239267537288629f883da/

ReversingLabs TitaniumCloud Script-JS.Trojan.Remcos

Threat name:

Script-JS.Trojan.Remcos

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-06 20:03:33 UTC

File Type:

Text (Batch)

AV detection:

7 of 24 (29.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zu2xbeqypzu4sywuymzyjvuko6z7argqlazdsjtvg4uimkpyqpna._file

Threatray unknown

Verdict:

unknown

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

execution

Link:

https://tria.ge/reports/240605-h9hppsac86/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

Checks computer location settings

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.