Extracted

• • Target
    goodthinkgsforbetterwayscoming.hta
  • Size 2.3MB
  • SHA256 902ef58dce89bdb4967c5514c2717aafe592f0e675ea8106270616a4694c01d6
  • MD5 b0987e566dd9fe03c463ad50c7b3a59e
  • SHA1 6d08559eb70647edbab850b45d8a27543e38e000
  • SHA512 4c52a59d102e53f8759128f2de788f507501ca37511cb2da3692ad0421a34fc7941844259f38aad58e8275c7c40b0b37b60a41bee086aad2467749cb4c574eaf
  • SSDEEP 384:4hPHmWtpjWY+TlrzygMAosYg0OBz4bNBYmg:4hPHmWtpjWY+TlrzygMAosYg0OBz4bQp
  • TLSH
    T1E7B51266CAB14FC1CC8E7769D3080529DD13CC605BA60F6B3A61BAE0C3D2C35B9759A7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backupremotediscoveryexecutionremcosratsuricata

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2