MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e33f75b43fb02cb692c326138d36287e0b08a781d35a1332cd5dcfaefcaf4eca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e33f75b43fb02cb692c326138d36287e0b08a781d35a1332cd5dcfaefcaf4eca
SHA3-384 hash:	389bb9740312c86e022f9f68c61ef2f52af91f7c6a1069fd6c98c815ccb75f9150f23ced7a94fc2697f47b05c349a8a6
SHA1 hash:	66c03fe7196107013f0fea8f5a6064335894e7db
MD5 hash:	43566ab5ccd1c1ed00fc9ee2d85274f9
humanhash:	arizona-michigan-mississippi-chicken
File name:	payload_1.vbs
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	130'136 bytes
First seen:	2025-05-21 08:45:16 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	768:t5s6+AQBTkZNDCf7j5GUID7Wb8IRdY/G9:e
Threatray	1'036 similar samples on MalwareBazaar
TLSH	T193D36459571A721ECA20F2E30E57F5C26A14D217E355A3107EA8C3F492BB161BC3AF2D
Magika	vba
Reporter	JAMESWT_WT
Tags:	RemcosRAT vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

102

Origin country :

IT

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.23586.1426.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=682d92b4c28c67d666437e51

Tags:

virus

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/e33f75b43fb02cb692c326138d36287e0b08a781d35a1332cd5dcfaefcaf4eca

Joe Sandbox Remcos

Result

Threat name:

Remcos

Alert

Create hunting rule

Detection:

malicious

Classification:

rans.phis.troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1695744

Signature

Antivirus detection for dropped file

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Connects to a pastebin service (likely for C&C)

Contains functionality to bypass UAC (CMSTPLUA)

Contains functionality to register a low level keyboard hook

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Contains functionalty to change the wallpaper

Detected Remcos RAT

Found hidden mapped module (file has been removed from disk)

Found malware configuration

Found Tor onion address

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Remcos

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Uses dynamic DNS services

VBScript performs obfuscated calls to suspicious functions

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected Powershell decode and execute

Yara detected Powershell download and execute

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

Yara detected WebBrowserPassView password recovery tool

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

89%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/e33f75b43fb02cb692c326138d36287e0b08a781d35a1332cd5dcfaefcaf4eca

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e33f75b43fb02cb692c326138d36287e0b08a781d35a1332cd5dcfaefcaf4eca/

ReversingLabs TitaniumCloud Script-WScript.Backdoor.Remcos

Threat name:

Script-WScript.Backdoor.Remcos

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-05-21 08:37:28 UTC

File Type:

Binary

AV detection:

9 of 24 (37.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4m7xlnb7wawlnewdeyjy2nripyfqrj4b2nnbgmwnlxh257fpj3fa._file

Threatray remcos

Verdict:

malicious

Label(s):

remcos

Alert

Create hunting rule

Similar samples:

22974a6d7748c8401d76df5d299e5db3f0ee4a8dfefc4444e85a7726dfc094b1

RemcosRAT

36f0f94a57df272434cffc01c7a8ceb67d4fab892bba5154a1fceaa38026e007

RemcosRAT

55664cf94d480b95c4c7b287dcb36ef045e77e59c3fd77867c872aa51d8ddbf5

RemcosRAT

5eea48e5b0a62f5149e6fc4cf92f370b27bc5f14e75f371a3c8cc7a97b9bd39d

RemcosRAT

7781549276d047ac3720ccdf20caf564e932a69b3910da10f400949c0a51a36f

RemcosRAT

abd1741192aa6e0d4291a33562e399c1dc503f9f9aec919d8e38ad07732a0954

RemcosRAT

c608c50993635a38c549100e604aaa86e7b4ac607afffb1f583e6ae5360bf6a9

RemcosRAT

ebc62381b9cb62c592f324514bb158fd78c914fab0783b3ffefa40245c87f2c6

RemcosRAT

error

RemcosRAT

f620ef8549eafd140bc89428027e3f379efac6e5af6ef52c0cda44600464c66d

RemcosRAT

fac461b593b89f4a155ec787787aa354975bb6d90d0d9d937254d8fa98c06155

RemcosRAT

+ 1'026 additional samples on MalwareBazaar

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

execution

Link:

https://tria.ge/reports/250521-kn2a2agn7w/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e33f75b43fb02cb692c326138d36287e0b08a781d35a1332cd5dcfaefcaf4eca