Extracted

Extracted

• • Target
    Product_Sample_List.js
  • Size 40KB
  • SHA256 6865a70ecd52fa5ab8b6f184573f93ce0bf5bd1a7e1f499842e7e494601091f7
  • MD5 1c8d8cb2e2b0f154538448c275dffcca
  • SHA1 ad78d5af7ef368629b56b5145f8c00855f198ce5
  • SHA512 e4545c41567379c7c821cc13ed98d99d37b6d29219c253c6a986224959b622e90f59311a74a274673e2be6415c92515fe009a6720880a735f86894b7a080e08e
  • SSDEEP 192:QVzUm3NSg4vaUfpVGpw6earUMYee5Ef53cWNla0154H2zCxbsJkHtOHrMG3nuQe1:QMU/WHVsgkXSLJihkaWiuJB1ZvcnZ4
  • TLSH
    T1500352241531318BC6F4550BCDA7E60B860DC8595D3C839BEF4B8B8FCAE568B7369E18
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  svchostdefense_evasiondiscoveryexecutionremcospersistencerat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2