Extracted

• • Target
    fedex_awb_bl_tax_bill_document_receipt_payment_05_25_2026_000000000.js
  • Size 14.7MB
  • SHA256 3e084f09333579e2abe333a817ea9e690a02c1dcc5b76c720dc2e208a77124e4
  • MD5 d796218fdaedd3706b81ac6f223fb685
  • SHA1 97cb86711894a8a7cc3d1164ad4bf8c4bdcbd17c
  • SHA512 73668677c937788a3361827bb9558f5c1768bbff6c6b6e24c13846723890345dd7fa7c68e7d8dbad8a52737ebd97a0c2af74b11eb2b8adbcd052958739e60532
  • SSDEEP 1536:ZrkJ/asryCWySlx86uOULSwaEDzNCirdSAcaFPjz8Z2rBIV867pcGiAd11iLd3r+:oENn
  • TLSH
    T11CF6C293886383F2E5A79D83EF514B7382773CFA5DA643FAD2230D89D77114AA011E91
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  now pocollectiondiscoveryexecutionremcosratspywarestealersuricata

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2