Extracted

• • Target
    23062026_0016_Richiestadipreventivo25540Michelin.js
  • Size 745KB
  • SHA256 f69cec27131367f1971b5b597c69c45dbae53c1c0efd56d04150f5db96adb3ec
  • MD5 9ef6bbc7d2a5558c9fbd8bde265cbade
  • SHA1 bdcd72471e70b9503bb5d8447903a3ffa3e35994
  • SHA512 0d662f994e316e05347ddaac70236def2303737153fcaaa7d5271bbb96d62267649a1975535fa69fac22210ed0236c09bf28b0b587afa0e19fb6f2ae51a976c6
  • SSDEEP 6144:8hs19d91aQPRlH49YcCAmBp4pwkp5XgIF:eF
  • TLSH
    T19FF45B20DD25076E0F4B17AAFC955B62CA7CC909562611F5FADE0B4D61028FCE3BF628
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionlucollectionremcospersistencerat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2