Extracted

Extracted

• • Target

    23af27b9003be7ccc30770282b14f25ee2acf332cbf721cdc0cd53e49a271b47.hta

  • Size

    130KB

  • MD5

    3df306ba89fd6f22237a3622e57292bf

  • SHA1

    7db9dc242d1688a289b9351b495b4005f8f8fa44

  • SHA256

    23af27b9003be7ccc30770282b14f25ee2acf332cbf721cdc0cd53e49a271b47

  • SHA512

    2cf927232740f533d647c4fcaabfe5e9a04a25d209f0318cdbfbdc3b86bacc2fcad8c6886671c2fbc9bc6b70b68000572bcdb187fc1e2f146ee4f2e94c32dfc7

  • SSDEEP

    48:7oagpd7Ah23j0u+leM6DXZFleM6NnRWeehHkCibpy2bFn72lHtqelgbpFadZ9lem:Eam7X+IdDX3IdmEFjbFHbC9IdUec7T

  Score

  10^/10

  defense_evasiondiscoveryexecutionremcosremotehostrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2