Extracted

• • Target
    LABOSERV_NB-0010214026_PDF.js
  • Size 16KB
  • SHA256 df4c77e19109b83fff25175d0cffcaee8ce74306df86df5cdbe58e4cd8b95b3c
  • MD5 ee518ca859a00f1f061cbc9a75326f8e
  • SHA1 bada5b55c9c2529fea7fa707464599b990b1944d
  • SHA512 d7db93bbc2bc8f074917acf2e4e129fb1989fe2841794217b7091935ba08463df210665ef569f19278d8e32511d5ebf88172b7589cded432057b0187fd85a75f
  • SSDEEP 192:p1ihqcev3No43G5AoGZ8rWoiDIej0saQHtlWsAB8vfBQ3fi5Egp2g:pKfi5Egp2g
  • TLSH
    T1AB7258AFCC040A6E2D6C612786FB447BA67B71E2F0A36A41704C5477FA95D83F448B6C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  mar endingcollectiondefense_evasiondiscoveryexecutionremcospersistencerattrojan

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass

    defense_evasiontrojan

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2