Extracted

Extracted

• • Target
    WhatsApp Video 2026-09-05 at 13.03.33.js
  • Size 489KB
  • SHA256 e0153e95ed7b5e86ff159aa8c689166916dfb1ee67b79198fa04e2e7dd0124ab
  • MD5 5dd15e83a0b06581d035c858c3eccbfb
  • SHA1 d3cdc646e1b9926ca491e81d5a1b0a2db46b7b0b
  • SHA512 d6f1cf3ac6b265a37aa9f5065ce4cc5da87b1c30b36e447123c0a962cd6d37632153253d33690af69d8c9f9d5a84c763be40cd5249efb790be2d9c43905880b8
  • SSDEEP 768:kldpBVzTMn5f6EhOmJNPr63ItAjYMmDwpGHt15ZfvdW4/O8IYKqgRN9ldBkD+LRu:kTVzTa5fJUcTgz9ldBRs
  • TLSH
    T17FB49DC2C9D6E1E4A09026CF1D40973596EC6A57895F1C06FBFC0209B7ABF1F29776A0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionremotehostremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2