Extracted

Extracted

• • Target
    WhatsApp Video 2026-11-06 at 13.js
  • Size 27.0MB
  • SHA256 6c4141ac47f47cf2bb184d69df68a23ea6d30f72afd4eaef98489c529f0f3ea7
  • MD5 2d5983dfe6d35d551d556eac135f1b7e
  • SHA1 3f3589e3613da52871832acbae530a91ed57ae76
  • SHA512 e6ad96858656680b25dc12cc37898de1357ec7e0a8254b34aad009161f513824bfc6c960a12aaaca07840ff4c4ee73bd5d64e75a65761def86596867ac286fdb
  • SSDEEP 3072:CxXmD0SuDzdsmq1hzBe98TFNb8E7TsyozrMVBkS2/jsUuI2p13D7V7h1XDUCHRnJ:9FnN+MfjNtLBHlDwb8
  • TLSH
    T1E8576B5EE8A537707ED8CAD5FE772A435D21C2A2230952326D373261AD00EDF62095EF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  windowshostdiscoveryexecutionremcosrat

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2