Extracted

• • Target
    givemebestthings.hta
  • Size 12KB
  • SHA256 47af1f0d9932840767920b3cb2befb3839bbc980e610c6a14327edf1b1682b2d
  • MD5 c0d94fca477cdc2dae48a0e450a608c3
  • SHA1 9f5c02e8b30738c4a1d52429023588a07ca79d64
  • SHA512 78c4bf096ef2ff17bc45905e6714a7885053a99dd27320111ca6a76874c3c2d7dc6d7eecfe38da06678c8ab8f3e24cc15d7f8333be046d52870f37238787505f
  • SSDEEP 192:Fp2Ma3TazlsLlcm6TacnUyAyVZTH7E2dn:FcMa3Taz+Llcm6TacnUyAyVZTbE2dn
  • TLSH
    T17F42F264C61DD7AC4AAEC72E9EBF0987D231CD124E00593B333C728F47206F5A697985
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  dymediscoveryexecutionremcosratsuricata

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2