Extracted

Extracted

• • Target
    Multiple Card Charges.js
  • Size 35KB
  • SHA256 24d1d96316519b7b18ea10057930b23cfd1e10067e2c1e903da63e5f75215446
  • MD5 e94cc563b70fb3e81c903a6e2d6b34ed
  • SHA1 96d84089af309b5695598409660af6b49e590384
  • SHA512 fc4b3fa62569fc240ee806cae1d48887a7420aab62b431e262223ad73307ca7612da78a0bc837953ac83a04faa65f31f7772f11e18306c6858243f5598614576
  • SSDEEP 192:xfGPlKHmSuVKFVIe+XbSdRtLYEnLbqnf9tkunGJsW1:k4GlcVIe+IRtLYELbqnf9tkunGJsW1
  • TLSH
    T132F23B3C45DE0E5EEA7395079E564AC9AC06DF36D818ECD60142F905DEA2FBCC798138
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  partneronediscoveryexecutionremcospersistenceratsuricata

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    Reservation.js
  • Size 35KB
  • SHA256 24d1d96316519b7b18ea10057930b23cfd1e10067e2c1e903da63e5f75215446
  • MD5 e94cc563b70fb3e81c903a6e2d6b34ed
  • SHA1 96d84089af309b5695598409660af6b49e590384
  • SHA512 fc4b3fa62569fc240ee806cae1d48887a7420aab62b431e262223ad73307ca7612da78a0bc837953ac83a04faa65f31f7772f11e18306c6858243f5598614576
  • SSDEEP 192:xfGPlKHmSuVKFVIe+XbSdRtLYEnLbqnf9tkunGJsW1:k4GlcVIe+IRtLYELbqnf9tkunGJsW1
  • TLSH
    T132F23B3C45DE0E5EEA7395079E564AC9AC06DF36D818ECD60142F905DEA2FBCC798138
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  partneronecollectioncredential_accessdefense_evasiondiscoveryexecutiondarkcloudremcospersistenceratstealersuricata

  • Family: DarkCloud

    An information stealer written in Visual Basic.

    stealerdarkcloud

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Uses browser remote debugging

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral3behavioral4