Extracted

• • Target
    awb_fedex_shipping_documents_08_03_2026.js
  • Size 8KB
  • SHA256 245a28d72da10e8e6b6ae3df799ef839a5250b45d848217fd68e94bacb4a79ef
  • MD5 b1da35b0bc67a5099493378e879e0fc8
  • SHA1 9232b1954e9127d3e4d2955ea5ccaef015add334
  • SHA512 52e8c13ab5edf467ec8bfeb86bfdfdbcae1aafeb1b99e03df4222c0edba52bc925041ff1370b7d5a2a1a06d49f6a1052fe8dc65ca092f8e16f69f9c3fb1b458e
  • SSDEEP 192:xy4A5ptrppJLuiGJcG3/lIl9LqaNwId7bGVhrLtKThuPq05xTSgHRIByv:Y97avQkHIE
  • TLSH
    T10C12FF4A56C87884E90F09C9C1D8FDD14169BE280717ECEB8E6D9B05B10AA37AFE4C17
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  crypters n tools aug-01-2026discoveryexecutionremcosratsuricata

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2