Extracted

• • Target
    weneedbestcreativeideasforbetterplacestocomeback.hta
  • Size 25KB
  • SHA256 e8f650779402a8ef804b198ddd52d6a87d1326eedaa02aeefea7affdddc8e744
  • MD5 5c452236742f70acb91541d18ad3d20c
  • SHA1 61ebcdde435fe3919d02a6316b79ab85da27b08e
  • SHA512 7eb6e8e176cc2ee0cc564e647a0222a1161ee9f22870064c4ab00c859b3bfb528e29d43b71ef51ef7b98a25a0af0cec9c281f09bbfd7ecd23069ecc45fe78767
  • SSDEEP 192:9eGweGweGweGweGweGweGweGweGweGweGweGweGweGweGweGweGweGweGweGweGT:XLZDjjqWi6J
  • TLSH
    T102C23B8AD27AEAED583249105E9C7850E82A78147772431F2A9C57EC9FC17C8FDF0D62
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionflamengoremcosratsuricata

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2