Extracted

• • Target
    Annexure-Specifications.js
  • Size 3.1MB
  • SHA256 85564a1a23b7e97d0cc205cca6783aa5e67a8c22b63f360b069ea8ed5462ac1d
  • MD5 0c871f4eee5af94f3cba5fde93f23149
  • SHA1 e143c951f0394fa0bca5aec720fd3cefd603540d
  • SHA512 a283491cfebe24c5b4948f8716eca3595fecd1a94f84401d7ae7711e496ead482d5de9a198c8b7fb94a6f42eb3040232b6fe8c10d5cc662fcec4c4dde05c439b
  • SSDEEP 24576:c5GGA+Renb3vwWk8qGj9vpY+BWVLywoOqviTacFlZ8zWqqMabg16KNl9wgqT4yJB:CRenlxpVLiGolZ8Kq0go89W/kv5u
  • TLSH
    T11EE5F2114EC42FB8CBAC5A1D50BE151EE3F18E8A5019B98AFB33BD46EFE7604510B1D9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoveryexecutionremcosratsuricataadwaredefense_evasionpersistenceransomwarespyware

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2