Extracted

• • Target
    Advice_id_103555_ref_21503033.js
  • Size 520KB
  • SHA256 eddc76033cea510a91a36ba5a6bfbc545986e51cbbb2a47e9601f777e4b951d8
  • MD5 7112234ca030f72009f72945a486afad
  • SHA1 f677cc2faa0ce7df37409a75d271fd19d673de93
  • SHA512 21d74ad80772f8d9b4ba5bb6ef79b8b7d5cb196bcc0950cca6d5dd6a21a1d6c97433e2f06ebe62158f2c8405ef2035c72b9ae390aab3817d15649fb331452b43
  • SSDEEP 6144:2kU9tEuG+WjmICE+PHMDEP8b1l62kSaR/hVNKNrE2B:2k2EuOmAWHMDx42kSg/hVNKNoM
  • TLSH
    T117B4538D4539F51514241E509FC18CD12B2D8E8F4F5E8D4FBD4E8BFCAAE61E800A7AE9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostexecutionremcospersistenceratsuricata

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2