Extracted

• • Target
    weneedbesththingswithbetterplacecomingforme.hta
  • Size 1.0MB
  • SHA256 0ad552eb950d47106026c8755488f3abd5c34429b4d773739770475f4635a68c
  • MD5 700ccd939712d52d9a72cc169a982896
  • SHA1 2265017ffb494dedece6cd1e9e551e1bd4251681
  • SHA512 1ef718177247bd70010201ffc1c9876212f7c7f60107995d877ad17a2c0b358255d5671939c38e871cd43cc74e80ff9ae7e013e06f757f9798b433874e25d8a9
  • SSDEEP 192:GGWD3sQ1kfzAE6WjpTp7+S6eTpGNwJzOkZbqxm2OnJyONnLFMbzliMbzb+l7cpD3:GGQIeWRpLph+rxvCx2zT
  • TLSH
    T15B35936A19F3941EED63C4B99F19943E5F2092A60DB3C1897070A4E26CCF785B90DF6C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionexploit aug-10--2026collectionremcosratsuricata

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2