Extracted

• • Target
    Multiple Card Charges.js
  • Size 5.2MB
  • SHA256 e2aa498ea12515bda490178f708405ffd4a50100c90291f544477b02ff299aaa
  • MD5 a34f40f10c55df256f127bd20839839a
  • SHA1 df0957030ff63cad26e451eceaab65c6ce04a7d5
  • SHA512 a94615ba6a93df1ab08bc3843423472ea817ee2bae3aa9d6289f070f343fe43ba30270189af62d6edb753cf9015a5eac81c8f00f0b50f4a3c9bb154e56819cce
  • SSDEEP 1536:Cbm5Un6b6XUWnLIY86DYFp68hlmjO+PtgpEbEcmvsHP2GJ0iXR4Cgze/KNTMWWma:FIvT
  • TLSH
    T100464E5B1F0C3E4EC4C65F6AA115D59FC088B6EA2910781E76CFECAACC74EA0FE19154
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  partneronecollectioncredential_accessdiscoveryexecutionremcospersistenceratstealersuricata

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Uses browser remote debugging

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2