Extracted

• • Target
    goodcreationforeveryone.hta
  • Size 233KB
  • SHA256 de80a885916a51aa14c8c439d34624c1a48a0767b29ea9e155cdca2d2e35a8e9
  • MD5 f48056aa699e5ae53d325281c593b314
  • SHA1 e22f7598510c8ee934f6d5e2b34f80af8fcb7536
  • SHA512 20848893013b50ac4031f5db64792924265a360740c68d0e5b82a13c7f3a36bffa9116ac1ef131e1e7625ba1c3219981140431010f8017d005125bb255432cba
  • SSDEEP 192:/ppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppA:/Ap
  • TLSH
    T1D334E076ABBBCC52AC708E01FFD0E7696826A7577C225734732E15E85E722CA21C5037
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostdiscoveryexecutionremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2