Extracted

• • Target
    goodforbestpeoplesaroundonmybestthigns.hta
  • Size 192KB
  • SHA256 7777f9917be9ce17233c35e1b38cbb34c45878c23e1b39d7956fa52cd7bb4983
  • MD5 97ac4d3415c0de5985c1f81ad2997fa9
  • SHA1 757cc90ae1863fd1dbe280e970099dd9ed4fa3e9
  • SHA512 e9a7eb35699e3c167559f2a53dbd33701798a705ecf710e9e279474eb343c8f9b4cdfe6bae27f979242c783f9c88c8f669ec8256008e2833200b5761c6d2027d
  • SSDEEP 1536:FUYOzJwNsCvSFOFZpeJD9KU2d9vFoJhqWSsmbavKin6Xh6gHwoSCBfDlpHNNnTKk:F0zFa6hpPK
  • TLSH
    T18B1430F335ECA5AA7B579E5302B2F162D1623BAA7A0345605294BE2313F0644FF0BC5D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoveryexecutionremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2