Extracted

• • Target
    FedEx_383730841513.js
  • Size 5.1MB
  • SHA256 a80272f531ce46aeb34408b922ab5437ba885a4bf535e36167217a0b7a51bb9c
  • MD5 546ceb7c675e080464c8e798a830ace5
  • SHA1 2bc7462b9cf55f149b7a3d2675badebccf4d04e7
  • SHA512 327ffdae647489edef515aed03f4ab5bc3077696cd08e3826b648676ee557ea97b0fb5c822f317b5b5e5f917cbd6df397e68339c07c9646fc493cac74b6d794d
  • SSDEEP 384:E1mOZ14UQM0JNqxg2j4Zlm6vfgzq+XGjrRP2X463lKhqVc0QW875u2UC+Kb4hdKm:EBccciyH3Y1
  • TLSH
    T15E464EB2913C5DA9148A93C4241EF600262D7230A3FB1FDD57BF52F6B7D3A458A0B9D2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotecollectioncredential_accessdiscoveryexecutionremcospersistenceprivilege_escalationratstealer

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Uses browser remote debugging

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2