Extracted

• • Target
    Product Inquiry.js
  • Size 55KB
  • SHA256 3508b55cbb53530a2bd9fec34a8c7f044841122db396049cb89df848c8cc154a
  • MD5 e97f6fd96ca2061ad9380c300a776fa5
  • SHA1 5835006e22394a19f27d3cf8841e52cb19f5357a
  • SHA512 0a93176cdbad5a362c48f858eaa996b806b5949c21499978a3b80c0d0175e1199aea4fdd56640bac59437d4f763970f6498de8ace933d4398cef3117175f139a
  • SSDEEP 768:3ITl5L7mP9l4YnY7+Gw1T0NyxIC1iBVATBdkWi1KHj1LuNhU3Xrc/j6m:38A2pAdkW7hqNBjd
  • TLSH
    T1EA43EC9A42C70A68D6620DC081BB611AD9F78D12584B78D9B74FF9DFE72C8C070E57B8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoveryexecutionremcosratsuricata

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suricata alert: REMCOS RAT Malware Inbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Suricata alert: REMCOS RAT Malware Outbound C2 Communication

    Network activity triggered a Suricata alert

    suricataremcos

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2