Extracted

Extracted

• • Target
    hddenovolvedforme.hta
  • Size 748KB
  • SHA256 7497e359bc00ee6ec94d4f42d74ba1128ef3873e947e6d60ace5ca0fbe336e41
  • MD5 1b3f0d1e676ea8c69aa89f85e1531f94
  • SHA1 f8e47f8e3e8d66fd3b14f0cefa1212a84cdecd58
  • SHA512 8f09a690ab799915d239dbffc85dc7ce519424cf19df29e0df1860c1cddc15c364bcc2967d1361aa57bece1c4a316ebbfea90619477b56ddbfb74669c8c78e93
  • SSDEEP 1536:T9rMcCO7CZzCZIZ7ueEtdJsppciIOVSZcHAZGednj9fJqwK0Si2mtY1MxqAMopOG:8X8njUqqeL
  • TLSH
    T166F4D7271A145C485772B2265BEE478FD490A21F8082D52BF7BC57009FFF82E479EE68
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  whiteremote32discoveryexecutionremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2