Extracted

• • Target
    Potwierdzenie_transakcji_CEN26081719026.js
  • Size 480KB
  • SHA256 fa0e2dced299a0877375a48ad0c52e65c7f7efe342a54e55597f073ae20ef17d
  • MD5 d5a15638eaea476138c91be17b2dcf9e
  • SHA1 d1ac01a10f1cfe334a1c729edf3f633b58bd8ad6
  • SHA512 57fe8009c3e98c362facb0aa68b8bad4e59f823193e5e1805e2f483c1f8b972dc6a025c7aa3ec56f8d2d7b097b4b7baa0d8ec9149903bfdcbb627ae84f166f8f
  • SSDEEP 6144:s4t2SSkqPAlZca/yu1bcvpCxRZO2Nv3vhy92SCJUptll:sje/lcqR/N3hYKIP
  • TLSH
    T17FA4540DE5A9E51D3E50187896209491E22F7CCF4F5F054F1D6E88FCFA8692880F7AE9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondefense_evasionexecutionremcospersistenceratsuricatatrojan

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • UAC bypass

    defense_evasiontrojan

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops file in System32 directory

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2