Extracted

• • Target
    FedEx AWB no 530526.js
  • Size 16.6MB
  • SHA256 44f7bc633fb44c58c2c0060945fe0db8d3aae62c64413984f54cb59a54f51a4f
  • MD5 7015cfca51f25e6ffb390e71d30d7032
  • SHA1 4c9d88f12e4a7283fbb4c0dff533d6bae148bcbd
  • SHA512 b7b84c1fe5de7b1f1d84367f9a3b4683f465fae33c00ed6001f62f13e8796128131f4428b2d1686bb4dc428fc8d5ac418f372c739fbee7873777f78f73686c13
  • SSDEEP 1536:Dio9CI7BeSeJNwkaSfGbW80DIfqFLcnLFaUrJgkAsUgEPEFfbZOcy1pQlses1S72:lvt2
  • TLSH
    T1C5070C2EC33567C9DD9ABB229E9CC45C0C9888AB2B71D05DB678C16DC9D773482CE361
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  hostcollectioncredential_accessdiscoveryexecutionremcosratstealer

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2