Extracted

• • Target
    FedEx AWB_Doc.js
  • Size 23.4MB
  • SHA256 e6281e5fa481b46cddcec262583b741e4414d29d08121a02c7e85e3a18403561
  • MD5 11b08540ef4f1c06e84ad12567a81bef
  • SHA1 c22d050ebab90e98007b036284980a1dd468c2ac
  • SHA512 e41fbf88f4c3bd0e9d5bae3a6023fbf8730c938557afa21df952f0a18d6f9fb1df4552e3eb2d8534d57e092740cf9e7d161b82053a60c24be1f13313cbd59d23
  • SSDEEP 384:Uj1fH4WRzfU6bUsEBslcAhSgeLE+pvJggyGQ576RyUOEaLG7cgwgvlPcPfqkHkNh:Uj1Ph8yu
  • TLSH
    T1E8375987051B6987C4872EA89D177FAA4CE07118B634F87EC793380B63B645F897399C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotecollectioncredential_accessdiscoveryexecutionremcospersistenceprivilege_escalationratstealer

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Uses browser remote debugging

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2