Extracted

Extracted

• • Target
    Quote Qr34255.js
  • Size 308KB
  • SHA256 8007179162a4f90597bf20a6088bb4f4589b0b220f80cb365ccb8b7f16a7da56
  • MD5 d74438203cc9ba4354db155e1a39f1c8
  • SHA1 329cb6b454c7db1c0122f2b29a717c94dc3b1db5
  • SHA512 a192a5b9819fc19d6d5df5c903ec4f91e5a959d47876e401140a6666b0c45b4293a16d0e2b5aca305f0ff91f5191af01f3901e9b33e994b35d7eaa23f5e726c1
  • SSDEEP 1536:v68hHuSncyF7J9MZe2Yo4UuUyMBDksF7rFr3yNmUNmsLfv63URUybFTs6b79tk52:v66fkFM7JgDg
  • TLSH
    T1CB64D278ED599CF4EF6662296C5CE667CB974F8B7002C587306CB7200F78C6D888B646
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoveryexecutionremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2