MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e7e78105c3946eb6ec2297a39ece3865c41f918d75d2a428ef53ef98ba0ad300. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e7e78105c3946eb6ec2297a39ece3865c41f918d75d2a428ef53ef98ba0ad300
SHA3-384 hash:	50040def062db007d390a020a2f67f0564fd679e6ad405ab5f22d28060915a419dfd2c557bb3c1dc9c1ecf2951fe62f7
SHA1 hash:	d02c6c02572271c7f768f59473c924477940b080
MD5 hash:	2d3da9702f38fc55c9abe1cb4e4242fc
humanhash:	asparagus-winter-vermont-oscar
File name:	PR3001789.js
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	1'610 bytes
First seen:	2025-04-02 09:39:36 UTC
Last seen:	2025-04-03 21:16:36 UTC
File type:	js
MIME type:	text/plain
ssdeep	24:0hdj9hz9z9/zdU5j9H19e9e9q9p9091919q92c9p9e9D9I9D9D919u919B9e9Ocq:O5725pYA
Threatray	2 similar samples on MalwareBazaar
TLSH	T13A31E9D7F2B106D885E350F6B37836D7F11070BDBB500814255D6682AF8E26A73D7A29
Magika	javascript
Reporter	TomU
Tags:	abby-work-gd js RemcosRAT

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

330

Origin country :

CH

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.PUA.JS.Downloader-133.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67ec1ae0cfd0a37f830ba12c

Tags:

autorun xtreme shell sage

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/67ed0610f274bf2d8e2e12ce/reports/3f650e2a-a8f5-43d3-90d5-0284ffa7e718/overview

Hybrid Analysis JS/Agent.CVI

Verdict:

Suspicious

Labled as:

JS/Agent.CVI

Link:

https://www.hybrid-analysis.com/sample/e7e78105c3946eb6ec2297a39ece3865c41f918d75d2a428ef53ef98ba0ad300

Joe Sandbox Remcos

Result

Threat name:

Remcos

Alert

Create hunting rule

Detection:

malicious

Classification:

rans.troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1654534

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Connects to a pastebin service (likely for C&C)

Contains functionality to register a low level keyboard hook

Contains functionalty to change the wallpaper

Delayed program exit found

Found malware configuration

Injects a PE file into a foreign processes

Installs a global keyboard hook

Joe Sandbox ML detected suspicious sample

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Schtasks Creation Or Modification With SYSTEM Privileges

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: Silenttrinity Stager Msbuild Activity

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

System process connects to network (likely due to code injection or exploit)

Uses schtasks.exe or at.exe to add and modify task schedules

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected Powershell decode and execute

Yara detected Powershell download and execute

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

85%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/e7e78105c3946eb6ec2297a39ece3865c41f918d75d2a428ef53ef98ba0ad300

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e7e78105c3946eb6ec2297a39ece3865c41f918d75d2a428ef53ef98ba0ad300/

ReversingLabs TitaniumCloud Script.Trojan.Generic

Threat name:

Script.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-04-01 16:57:05 UTC

File Type:

Binary

AV detection:

4 of 36 (11.11%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=47tycbodsrxln3bcs6rz5trymxcb7emnoxjkikhpkpxzroqk2maa._file

Threatray remcos

Verdict:

malicious

Label(s):

remcos

Alert

Create hunting rule

Similar samples:

0c25fdd6e72006a4896e82aef58f05e9177a07d75aeff4eeb85dd7138ffb52f6

RemcosRAT

7c0946cd8a228f35db68a9bd702e283a3ab9f41113bede7ed206e9af5f824c9e

RemcosRAT

error

RemcosRAT

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos botnet:abb discovery execution rat

Link:

https://tria.ge/reports/250402-lndemsxms9/

Behaviour

Kills process with taskkill

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Blocklisted process makes network request

Remcos

Remcos family

Malware Config

C2 Extraction:

abby.work.gd:2413

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Remcos

Threat name:

Remcos

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/e7e78105c3946eb6ec2297a39ece3865c41f918d75d2a428ef53ef98ba0ad300