Extracted

• • Target
    weneedbestthingsfromtheheartformeebest.hta
  • Size 463KB
  • SHA256 ef616ac07f9d48aef418e892e4e6377109eb1ea54354f8a573ca8c0677427aa6
  • MD5 5b79de01d0e7addbf43a0af62e20251f
  • SHA1 59cf6c16b90386f116b4ddecad01dd4fbc599efc
  • SHA512 62028fc7841a42d78da330ea24af3bd5af884bc0deae40040924376c3fdfc78b76268e5b1466955fad679c143f5a135cf82e0556fbf1f97ed3c348490d9b8a7c
  • SSDEEP 768:NkCjOO3Rx3ZpSWF3l63HFG33xVaWF3VBUk3TO333dkud3LNaPWh8klxtMuuY+TU5:hopx
  • TLSH
    T1B6A4A73383565048BAA0B0B48C05E3DA979FC70D4756897E36FEA19D22635C8D0EDE7B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  nwimnmitcollectioncredential_accessdiscoveryexecutionremcosratstealersuricata

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Uses browser remote debugging

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2