Extracted

• • Target
    PO-230102 and PO-230103.pdf.cmd
  • Size 5KB
  • SHA256 cdb455da52d34e98efe41cdb46fc7582f1778e9e8bc33c4bd33ae9f510b1ce01
  • MD5 adb684e46291c278e0535f32a64ccd7f
  • SHA1 5cad791ee232dd7ee3453ef9651a31193020fa90
  • SHA512 24547eb64728f11618464a8fa28e68cf6372199387fcd445f650090fd712ae29a28973cb671494d750059847d08fae9aa3a40eaa32bccf13d35e02bfe2d1898b
  • SSDEEP 96:eY8+q/FjMbPxVN24aA4qAOrPub5KXE4OCAXHUMAIhc77qggRqAxcgbQO:ip/FjMbPxVNsACOoyE4OCA0VscgbQO
  • TLSH
    T10CB1A435630AF19146E70504A669EC876179AB744788DE0CF2EAFB0ECD52C1CA77D4CC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  happy-lifedefense_evasiondiscoveryexecutionremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2