Extracted

• • Target
    New Purchase Order 4585123535 Printout.js
  • Size 33.4MB
  • SHA256 3dab962fc509e18e91291dc8a480e0f58053e46214bdd134e3d6112f663e86d8
  • MD5 004575cd0efe29a0fe84c29fb7af218c
  • SHA1 c46ba9aa0778f2c485a292a649985df57013eb82
  • SHA512 691f2c98f70da794fa04345e787608fd9b4936f7f73f9233bfa8feef61b757f1d7f109efc1267438b68f00606d48712e079a055953d6807d86a2d77417c2ca03
  • SSDEEP 1536:gB7iT26pXMBJRuk2I7I/hjLBsgXWLtXUrqJPjKE4s7cU:Mqrm
  • TLSH
    T12D7739E6DA7C46FE9001BE1F6C786C2F1A656E12E4A0C3C7996BC5CBAC49C58241713F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  newpat4collectiondiscoveryexecutionremcospersistenceratsuricata

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2