Extracted

Extracted

• • Target
    Details to Tender Bid.js
  • Size 995KB
  • SHA256 64449f93ea29a1eda4a366bf17c45c2f2c39d294a92a9e0a5a0d6ede63faeb68
  • MD5 5a29a68730b91d7f9b4e05235166b02d
  • SHA1 13be206e4efb3297b7b0b6e9b1d4e85692e88287
  • SHA512 919f0232855b6cac03b4631a9a2332c8f96e5dfb6ee810318b1dad9104316552ff4a587be2bf10fe28e3148a7f82c99e15ea3f7cb8d23cacbf1d815da1aedd08
  • SSDEEP 3072:/qzsAjc+4o15yOW8SnYKZg8/q48VqTBO5zCO5fGbLOOlCuGbMmGbyN/xex5CHQJc:A
  • TLSH
    T125255EEFBBB747EB69042145CF4D5A3C9E536B8EC8B8867EB615C34824758E81D048F8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionremotehostcollectioncredential_accessdiscoveryremcosratstealer

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Uses browser remote debugging

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2