Extracted

Extracted

• • Target
    Tender bidding details.js
  • Size 382KB
  • SHA256 94ab14ed7de4a71b27dfb15e3851cf23f7b5a604ef2990bbeadcdf67e067beb3
  • MD5 e8bcf3eb1cc161ca0a92cd6f687eb0cc
  • SHA1 b02dd18b55df988a08549790edeae73ddde0a0d9
  • SHA512 340773290cd405cd409375f1a9d3eb5d39fdc75dee67cb2956139ca8fc63af33683da9989302136a0d96b71fed1bcb3ecab90a4f3d1edac14ea1b3f6318e6885
  • SSDEEP 3072:EojxJN1y5DPEE6oWu4+1VggP9Hxu91lZYd:kEE6jG
  • TLSH
    T1F3841A602CEF10DC7273AB511BD8B8FF0956F4762A3E61B821529B454B36EC4DCA2B71
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoveryexecutionremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2