Extracted

• • Target
    goodcommunicationskillforbestpersonhave.hta
  • Size 1.0MB
  • SHA256 53b64d735a9fb66413dcfb2e78def2e785b78133452fb2acd6bf9c4364e0f2a9
  • MD5 f1f3bd972634cdcacaebb5a1fa5dc90b
  • SHA1 24f36ba495aa5d825429eac6fef2be8b9eb02d21
  • SHA512 19cf12a304d21d0f5899aef6e27d12799454df21dac1083b59409c8921ba338e8495a086fd26b6c8dc7a47c18cc8cdcebed9a77c284ac9393ff5abd10fdbf508
  • SSDEEP 768:bzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzX:F+M
  • TLSH
    T1403532FF31F0D861AA1051C48F85BAD1DB4E324690A6651FAE95D1CEB94CA0CE379CBC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  zenithdiscoveryexecutionremcosratsuricata

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2