Extracted

Extracted

• • Target
    MEDUGK931749.js
  • Size 63KB
  • SHA256 14871ed0de7fb24775a7c51fb6c88c68a02d31a07050612e457b7f2b66a06285
  • MD5 f1a69468a2ff0e5ff1080e9523d95b5e
  • SHA1 e0b4758f76c5b3c1a812ace8f22de8dd4a75b7ce
  • SHA512 e5e8d86712a0e4da5cbcb59bdd67d8369883a8cdb36e0d9d1b57ab684efcbb178c7e0873ab9cc3f642e5f184750638b5ba7b9d18d99f803062f2e8f91309dee6
  • SSDEEP 1536:b1EowdAUTYRwyeYT5YpoYx9xMAgoPYFJLbbs1hAtSG3RluJa2AzFA:REowdAUTYRwyenpoYx9xMAgoPYFJL/sF
  • TLSH
    T1D15342FE46452CBA1D9E5FACFCC594654E4A0F6261F5C216A608789FBE18CD8004BE3F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostdiscoveryexecutionremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2