Extracted

• • Target
    goodthingswithbetterplaceawayfromthegood.hta
  • Size 215KB
  • SHA256 11f09a5d97312bf11f74710b27f9792629e023d69775aba91fef158350d6ff96
  • MD5 62d70997f46c365efd3c83d0188fe8a1
  • SHA1 bcba6dfb18fc03ae7573f0ffcbe9b6b29f4bf560
  • SHA512 bd359c4d8bca89635d5d311e799c8f39e7a160c9ca949ab9037636f3c3f303a57267fba441e5adfcb60b743b29d6d8a3baba6a6d117db3d8f295adda4a5ce70c
  • SSDEEP 768:FBPEk5BogP9QupWXwrzOfuM1kL+GIBDcwdQdjweeJisa5geflffQuc/:FJY1omtD/
  • TLSH
    T1422413217883B836037EDF8255D94E9FE9808A4B4791DEB96AB5B3C30716F0633176E4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  exploit 25-06-2026collectiondiscoveryexecutionremcosratsuricata

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2