Extracted

• • Target
    wegivingbestthingsforbetterplacescoming.hta
  • Size 391KB
  • SHA256 586b5f99252301bfe28eff60e5a2ee3e5399adfcbebc72de00fbda5dabf791cb
  • MD5 eaa38a1ee06858bfbc6f2fba63e6a0a3
  • SHA1 5016cf66c3fbd03229662e5790a12ab6f1aaea7b
  • SHA512 852ef5ca2b6f4e8889767e8d07f9c90600f55e0908a22adaf85ce1fb1eecd99d4bdc5cf5d718324ff1391503bd755b78eb9a9d7a7b1978c458d91a71f14b4357
  • SSDEEP 768:sUOBGB+JVVQBlBFI7BLSBQhUzb+/cva1TBvBtBBfcgjVlKtBBmYBIwIws82cSKjS:x63
  • TLSH
    T1EB84227703D68C89AA7871689D07C82FAB11710A8A5DB54B7C7C9087737B2895378FBC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  exploit aug-06--2026discoveryexecutionremcosratsuricata

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2