Extracted

• • Target
    Orden de compra_52177236.js
  • Size 434KB
  • SHA256 4c446650d42ae67be1a86da5e99dc7ebed15e2b70137044bc4fb8d955d191f1c
  • MD5 842298f2e70a3e4a76b10c6a81106865
  • SHA1 cf09e89aa9b07d67cf028cc349906c2be8d159dd
  • SHA512 515247cb5d116fd98c6389b9d75a87793ece9af2c274cc693276c224aa4cecdfc5cacf51d74e610d0423436771a2b58bf287e5306a4169d827e6c5a3c4ba32b8
  • SSDEEP 3072:Uygw7YQqLZI2Za3uL09xrGVfPd4HljoTrKcehQPWIKx6giCsQK3cT1MYZ:9
  • TLSH
    T1AA940653A3FA0648F1F78F496A3782650A7B7E519C3DC25C229CA45D0FF3A44A861B73
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectioncredential_accessdiscoveryexecutionremcospersistenceprivilege_escalationratstealersuricata

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Uses browser remote debugging

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2