Extracted

Extracted

• • Target

    goodthingsbestviewtoseethebetterthingswithmygirlfriend.hta

  • Size

    131KB

  • MD5

    3ea42c07ceb45070164bd1f477a88133

  • SHA1

    d7962b4b8f067a50c6efac4fcf0afa3ff60e0eb5

  • SHA256

    bf19247ad0e4d4f0e932be829ab5ef3c0921c637faa85844aa22975126b5d0c7

  • SHA512

    5fcb742dc63d4a48fee28fd776a7bd48089f4ae29cf560c1ebd98f282fd023810b5fdc0b93ed7d6f3fd1eec36e4614d898e2319a20c5aa94b4b043d887f0e9f1

  • SSDEEP

    96:4vCt7ttKm+IgwtKm31IgMhCY3Ck6j8PtKmOYtKm5hz5OIgTUtKm8Q:4vCFttKmUwtKmX3YTtKmBtKmewtKm8Q

  Score

  10^/10

  defense_evasiondiscoveryexecutionremcosremotehostrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2