Extracted

• • Target
    ad468c45522cddd5c412a6a65269b388.js
  • Size 33KB
  • SHA256 08f4e43fac6f13d0e30b38273d7e2885a76cc5024b91dc2a1bb9ca971d47786e
  • MD5 ad468c45522cddd5c412a6a65269b388
  • SHA1 68b13bb96b300bd4f30f44cbed938901f8200164
  • SHA512 e16a6e56859cee6c7b8cc1110f203cd39ad35119d4043540505509bfc012011329431b6ce279670bb428d47d29a7f37e9943d82da74aaffa230c8b11d1994d0d
  • SSDEEP 768:jeaZDG7G+xeOJOL5My0XPqtSi5/P3N7a1:8UnG
  • TLSH
    T150E21EC336526728BABAB43CA946C4546FFD3F430F90D86756919DD9BFA048B891B00F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostcollectiondiscoveryexecutionremcosrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook accounts

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2