Extracted

Extracted

• • Target
    1064-RFQ-3L50050098CR807.js
  • Size 1.1MB
  • SHA256 0fcd2714fc541ef44810795e3a88e58beba7e5a555aae62493b158acde04d3ab
  • MD5 ab0288718069561a86e832ff25ab0ea3
  • SHA1 2e4833fd505be7ba4196e289cbefe9a9c5ce9fe5
  • SHA512 b5151bef4cf7fba029b930845a004ddda5ecd5caad27fc69ba166e6edbcbd951107b1366a0f35f83f8dafb27bb887a0cef115ec3930b3a5388239e56f9a9332f
  • SSDEEP 1536:p9cT+YGNXZPP8+Kh9MJUSTMuSWtStUrrgPpmlzSn9fWfkFtS4JE325E9VlFS2O4m:wv
  • TLSH
    T1C945F9FD1CE37F12A544CBD05909CA8DFEB598951880C85C60D9E2EE071C7762BBADB8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  jim_remscollectioncredential_accessdiscoveryexecutionremcosratstealer

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Uses browser remote debugging

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2