Extracted

• • Target
    heisthebestthingsforbetterplacescomingfor.hta
  • Size 14KB
  • SHA256 7ca4e6b027580a7227aa4a0f4f8081767c58232cb867c8112ea47d37d6868c40
  • MD5 e55bad8ff043b878985eeedbca23c9f2
  • SHA1 4bce23d8305f846cfda59ee07fdbae2355b80ee7
  • SHA512 0a4fef57f58ffb190615c1961969aa04856377a6c3ed0d06eab089b43e17b1f1668f3a0115984b0c13bcef0ec31afb4f0645f7f6294823413313f8e2009b9e3e
  • SSDEEP 384:F7VNHrImPmiJMJkaAjQEUE5AjnREWCedSXcE/4dO:F3AbtA4Q
  • TLSH
    T145627E9BE17202A4AC729AE31E58B8F9720BF0C7EE84A5757D1CA9741FF119C36C7091
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  alocryptdiscoveryexecutionremcosratsuricata

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2