MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e55e51ba81d7a7168f58498797cbdecfed9ad3ca26fee6043efeb4a1f7453b3f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e55e51ba81d7a7168f58498797cbdecfed9ad3ca26fee6043efeb4a1f7453b3f
SHA3-384 hash:	35f9125849e762b1bd853f9f6e0d1e66e3490476074de530b5c43d4063777780791abc4ce96e32ce4389ad7c4bc7bb4e
SHA1 hash:	b062d85bcbde7df13a75a80f07b19a0237b00ecd
MD5 hash:	d81969601d9d0b7b001bbcafce3377eb
humanhash:	quiet-glucose-glucose-india
File name:	Orders.hta
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	16'172 bytes
First seen:	2026-07-22 06:31:38 UTC
Last seen:	Never
File type:	hta
MIME type:	text/html
ssdeep	192:gqrmE9Aw7zdP0IEwJVWTTbQniNVgDqJJg5s:L46hXQjQiNyGf
TLSH	T14372427D8009D9D43167BAD96D26C6B96050D6CBE0B07DF22EABD75F8A2320560C27CF
Magika	txt
Reporter	lowmal3
Tags:	hta RemcosRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

88

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win32.SuspectCrc.11136.8900.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a6063d5bcffb2c48cb7c9a5

Tags:

obfuscate shell sage

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/e55e51ba81d7a7168f58498797cbdecfed9ad3ca26fee6043efeb4a1f7453b3f/results/dashboard

Behaviour

BlacklistAPI detected

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 powershell.exe

Link:

https://www.filescan.io/uploads/6a6063cfa49b7e7a1132db9f/reports/d5aedf5c-1982-4ef6-a2e4-7fd46e97f98b/overview

Hybrid Analysis Trojan.HTA.Remcos

Verdict:

Malicious

Labled as:

Trojan.HTA.Remcos

Link:

https://www.hybrid-analysis.com/sample/e55e51ba81d7a7168f58498797cbdecfed9ad3ca26fee6043efeb4a1f7453b3f

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

hta

First seen:

2026-07-21T01:05:00Z UTC

Last seen:

2026-07-22T03:01:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/e55e51ba81d7a7168f58498797cbdecfed9ad3ca26fee6043efeb4a1f7453b3f/results?tab=lookup

Joe Sandbox Remcos, XWorm

Result

Threat name:

Remcos, XWorm

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1946285

Signature

Antivirus detection for dropped file

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Contains functionality to bypass UAC (CMSTPLUA)

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Detected Remcos RAT

Found malware configuration

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Remcos

Sigma detected: Suspicious MSHTA Child Process

Suricata IDS alerts for network traffic

Suspicious command line found

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

Yara detected XWorm

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

49%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/e55e51ba81d7a7168f58498797cbdecfed9ad3ca26fee6043efeb4a1f7453b3f

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

3 match(es)

Tags:

Html

Link:

https://app.malva.re/file/d81969601d9d0b7b001bbcafce3377eb

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e55e51ba81d7a7168f58498797cbdecfed9ad3ca26fee6043efeb4a1f7453b3f/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4vpfdoub26trnd2yjgdzps66z7wzvu6ke37ombb6722kd52fhm7q._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery execution

Link:

https://tria.ge/reports/260722-hafq3ael6z/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Executes a command shell one-liner

System Location Discovery: System Language Discovery

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Badlisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/e55e51ba81d7a7168f58498797cbdecfed9ad3ca26fee6043efeb4a1f7453b3f