Extracted

Extracted

• • Target
    Ref-00145_0608026_xlsx.js
  • Size 929KB
  • SHA256 6f69e704739b26996cf7b5513e9e121a622429c6973b4c8fd1144c6f71d6758b
  • MD5 7cb6b94bbddd4d6a0c846df770275664
  • SHA1 4a318519799b85e0f48c3d0a62d9d6713edca522
  • SHA512 67758435c6c32e3f613c339aee2a3145fee977b2a6826f158ed077068ee49642a8637c78005bee6b8309e13fcf50ec83fd4b3f201518521b1d188ffaf7c556f7
  • SSDEEP 1536:rMPZqpYzL211pYqTAq7SYYnzOzlzGVYzGGzzqpJ/ZxGpk0Yqpi1wqYzA1p+YbyC/:LoM0M9MiF0
  • TLSH
    T1C3155F1F5E43865580089C6CC863DD1FDFAB068A0466FC9EBAED8DC54EB0406725BAFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  x64collectionexecutionremcospersistencerat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2