Extracted

• • Target
    kissedbyprincesssheisbeatufifyl.hta
  • Size 26KB
  • SHA256 cab33e022b881d0902be5a495f2a1e669910c876bb9f26e8d7e105b2cf17e694
  • MD5 b8f8afba0e59914236723c5ae8a60d57
  • SHA1 166ebbbe49cd496fd22c0be5c91ea868050fa8f4
  • SHA512 0886245d55ed8255e31041400e80e5f8fa79ea5206d00194fa382014e57b7b2ad5a19a33998b49a2e403b6ed7c5859bfd0f73b5ed78622b32daab343136fb82e
  • SSDEEP 768:ODDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDJUDDDDDDy:an
  • TLSH
    T15EC253CBCEAB0BB4D51277F0A60D9C8B6BBD446989976C3635948B50FA49440F3E0EF1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionreghostcollectionremcosratupx

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2