Extracted

• • Target
    Orden_de_Compra_2026-07-04.js
  • Size 110KB
  • SHA256 5deb85e0d89bf551bce88ebfd68f4566a188f8bce883a90d12501c5268a9b3d0
  • MD5 43260417b42c4de41ad8e3a1c256f94d
  • SHA1 c469ff0401de63e4ce9f24979eb1b7e71cb0c0af
  • SHA512 f5fa3d44591a21f257b61a03549cf25f078f5e88d770496427561caa7e05f3363d8936935c4c9c2315229c6e26c0b16cda15182751400c60d7a884ec952ebbc1
  • SSDEEP 1536:Mysh2keAWh/y3cUO34WSizJiPMCM3QmpWOwcSWlYvD66rliN42U7bqLLF7k6qeh:38DvWheIbTzJxCM3fIOZSWWktLLFY6rh
  • TLSH
    T176B35B20ED380AB70F531B9DFDA44661C9FD8209462660F1F6DB470E61065ECE3BE769
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  ojiigbo_discoveryexecutionremcospersistenceprivilege_escalationratsuricata

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Use of msiexec (install) with remote resource

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2