Extracted

Extracted

• • Target
    verygoodprojectwithbestpersonforme.hta
  • Size 24KB
  • SHA256 bb5f61f173f302569215b36f0ec5e159e22e5d7959dfcc921ac786361e39c479
  • MD5 d48b22ce508a21b6c372da55d21f78da
  • SHA1 505a30ce4dbf4e513a7f20206b1112b6817aa753
  • SHA512 20118be5173741f93a9882834c697429c732ac0a949e32cf0bbd52864927e42e191d8512ef30f9341fc73ff58a2236a90d8fdfb3581c3bafbd845285d3b8e488
  • SSDEEP 96:XOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOUTpLWwE:EpHFJ/tXZykMcFev
  • TLSH
    T126B28034D28DA31E525D21706BE71534A90CA7958FD680BE7FFCA143FAC79601EA6E30
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  purchaseordercollectiondiscoveryexecutionremcosratsuricata

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2