Extracted

Extracted

• • Target
    Revised Quote Price.js
  • Size 387KB
  • SHA256 bfd8285ddd6fa6560774ab40fff7e58936bdb1ef57a5ae884675cca6bfea9f16
  • MD5 07f7d72fcde25e1ac561af7c4d71df3a
  • SHA1 8c9d4c3fa26663da0bc9e9e324239a417f5a9a70
  • SHA512 ceaa13a8c492d1a54682b8f5eaac7756840d31c6387ca947ff5a40fadd4ad979bd56a5fcca18e1fa7fd557026abe1a943188639fb1f2d9c12f40c4d1b717039f
  • SSDEEP 3072:xVOzjMuK7UdDrcx8fwMkdeseUlRCQ3OETrlYwPfi8hhInWKpZ8wU2PP2shJ+4z/Z:M3sn75ECJQ7
  • TLSH
    T16484B6CE0962358636BE8E6568E610C58E6336435B739E0C627E135F0D5623CA4CBF7B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoveryexecutionremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2