File name:

Artifacts-2025-05-15_18-46-55Z.zip

Full analysis: https://app.any.run/tasks/ed86e298-54bd-478b-8662-13387a121d4a
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: May 15, 2025, 18:52:54
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
remcos
rat
remote
netreactor
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=AES Encrypted
MD5:

701FE971CC7A946D5C86637F5917600E

SHA1:

DC440DC7DAC08FBEE797125C59395BEC39066945

SHA256:

289B773653201DE1F3487770A57DF63343F79D0ACEA4794262ED80AE7B34272A

SSDEEP:

49152:+a5rGfxHIVDUpYvDog//mCz4e8IkJ4AFiKahO/qO+1zh4AGoOoVhBjLRYXY98mEc:JrQoVgYCU4FJNFiJIWzlHxLmXrHFAlc4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 5512)

    • Uses Task Scheduler to run other applications

      • Sichuan Procurement Co.Ltd PO-92001.bat (PID: 5964)

    • REMCOS mutex has been found

      • Sichuan Procurement Co.Ltd PO-92001.bat (PID: 5988)

    • REMCOS has been detected

      • Sichuan Procurement Co.Ltd PO-92001.bat (PID: 5988)
      • Sichuan Procurement Co.Ltd PO-92001.bat (PID: 5988)

    • REMCOS has been detected (SURICATA)

      • Sichuan Procurement Co.Ltd PO-92001.bat (PID: 5988)

    • REMCOS has been detected (YARA)

      • Sichuan Procurement Co.Ltd PO-92001.bat (PID: 5988)

  • SUSPICIOUS

    • Suspicious files were dropped or overwritten

      • WinRAR.exe (PID: 5512)

    • Executable content was dropped or overwritten

      • Sichuan Procurement Co.Ltd PO-92001.bat (PID: 5964)

    • Reads security settings of Internet Explorer

      • Sichuan Procurement Co.Ltd PO-92001.bat (PID: 5964)
      • Sichuan Procurement Co.Ltd PO-92001.bat (PID: 5988)

    • Starts application with an unusual extension

      • Sichuan Procurement Co.Ltd PO-92001.bat (PID: 5964)

    • Application launched itself

      • Sichuan Procurement Co.Ltd PO-92001.bat (PID: 5964)

    • Contacting a server suspected of hosting an CnC

      • Sichuan Procurement Co.Ltd PO-92001.bat (PID: 5988)

    • Connects to unusual port

      • Sichuan Procurement Co.Ltd PO-92001.bat (PID: 5988)

    • There is functionality for taking screenshot (YARA)

      • Sichuan Procurement Co.Ltd PO-92001.bat (PID: 5988)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5512)

    • Manual execution by a user

      • Sichuan Procurement Co.Ltd PO-92001.bat (PID: 5964)

    • Checks supported languages

      • Sichuan Procurement Co.Ltd PO-92001.bat (PID: 5964)
      • Sichuan Procurement Co.Ltd PO-92001.bat (PID: 5988)

    • Reads the computer name

      • Sichuan Procurement Co.Ltd PO-92001.bat (PID: 5964)
      • Sichuan Procurement Co.Ltd PO-92001.bat (PID: 5988)

    • Creates files or folders in the user directory

      • Sichuan Procurement Co.Ltd PO-92001.bat (PID: 5964)
      • Sichuan Procurement Co.Ltd PO-92001.bat (PID: 5988)

    • Reads the machine GUID from the registry

      • Sichuan Procurement Co.Ltd PO-92001.bat (PID: 5964)
      • Sichuan Procurement Co.Ltd PO-92001.bat (PID: 5988)

    • .NET Reactor protector has been detected

      • Sichuan Procurement Co.Ltd PO-92001.bat (PID: 5964)

    • Create files in a temporary directory

      • Sichuan Procurement Co.Ltd PO-92001.bat (PID: 5964)

    • Process checks computer location settings

      • Sichuan Procurement Co.Ltd PO-92001.bat (PID: 5964)

    • Checks proxy server information

      • Sichuan Procurement Co.Ltd PO-92001.bat (PID: 5988)

    • Reads the software policy settings

      • slui.exe (PID: 6040)

    • Creates files in the program directory

      • Sichuan Procurement Co.Ltd PO-92001.bat (PID: 5988)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(5988) Sichuan Procurement Co.Ltd PO-92001.bat
C2 (3)127.0.0.1:47666
196.251.93.24:47666
iamsoblessedin2025.duckdns.org:47666
BotnetRemoteHost
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueRemcos
Hide_fileFalse
Mutex_nameRmc-25V99Q
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
Max_keylog_file100000
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0009
ZipCompression: Unknown (99)
ZipModifyDate: 2025:05:15 18:46:54
ZipCRC: 0x1a5c0a2e
ZipCompressedSize: 904424
ZipUncompressedSize: 963072
ZipFileName: Sichuan Procurement Co.Ltd PO-92001.bat
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
135
Monitored processes
9
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe sichuan procurement co.ltd po-92001.bat schtasks.exe no specs conhost.exe no specs sichuan procurement co.ltd po-92001.bat no specs #REMCOS sichuan procurement co.ltd po-92001.bat slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
856\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1280"C:\Users\admin\Desktop\Sichuan Procurement Co.Ltd PO-92001.bat"C:\Users\admin\Desktop\Sichuan Procurement Co.Ltd PO-92001.bat—Sichuan Procurement Co.Ltd PO-92001.bat
User:
admin
Company:
Nucleogenesis Laboratories
Integrity Level:
MEDIUM
Description:
HeliχPrime
Exit code:
4294967295
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\sichuan procurement co.ltd po-92001.bat
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2040"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rpxETSofm" /XML "C:\Users\admin\AppData\Local\Temp\tmp75C9.tmp"C:\Windows\SysWOW64\schtasks.exe—Sichuan Procurement Co.Ltd PO-92001.bat
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4208C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5512"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Artifacts-2025-05-15_18-46-55Z.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5964"C:\Users\admin\Desktop\Sichuan Procurement Co.Ltd PO-92001.bat" C:\Users\admin\Desktop\Sichuan Procurement Co.Ltd PO-92001.bat
explorer.exe
User:
admin
Company:
Nucleogenesis Laboratories
Integrity Level:
MEDIUM
Description:
HeliχPrime
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\sichuan procurement co.ltd po-92001.bat
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5988"C:\Users\admin\Desktop\Sichuan Procurement Co.Ltd PO-92001.bat"C:\Users\admin\Desktop\Sichuan Procurement Co.Ltd PO-92001.bat
Sichuan Procurement Co.Ltd PO-92001.bat
User:
admin
Company:
Nucleogenesis Laboratories
Integrity Level:
MEDIUM
Description:
HeliχPrime
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\sichuan procurement co.ltd po-92001.bat
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Remcos
(PID) Process(5988) Sichuan Procurement Co.Ltd PO-92001.bat
C2 (3)127.0.0.1:47666
196.251.93.24:47666
iamsoblessedin2025.duckdns.org:47666
BotnetRemoteHost
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueRemcos
Hide_fileFalse
Mutex_nameRmc-25V99Q
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
Max_keylog_file100000
6040"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6644C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
3 202
Read events
3 178
Write events
24
Delete events
0

Modification events

(PID) Process:(5512) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(5512) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5512) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(5512) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Artifacts-2025-05-15_18-46-55Z.zip
(PID) Process:(5512) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5512) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5512) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5512) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5512) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(5512) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE0000003F000000BE04000028020000
Executable files
2
Suspicious files
2
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
5988Sichuan Procurement Co.Ltd PO-92001.batC:\ProgramData\remcos\logs.datbinary
MD5:A726177665361279EBCE506B1292C924
SHA256:671310095CD43E30EE22CD8A0AB700B7F8E2E3AAAF1B54CEC7ED1B53945051E7
5964Sichuan Procurement Co.Ltd PO-92001.batC:\Users\admin\AppData\Local\Temp\tmp75C9.tmpxml
MD5:7F1E6D5D549487147F9C3E6EF75A8EC8
SHA256:7FAA3C840047BBC5C7B2DF2797B3779E353755B761084AC9F0D15CB170E7B930
5988Sichuan Procurement Co.Ltd PO-92001.batC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\json[1].jsonbinary
MD5:0376268AF8380015A334B007170ABBF8
SHA256:2FF81EAA9A1F17DE9F9F571CE06E8E43F98A3362E4B65A84C4A968E24479C90A
5964Sichuan Procurement Co.Ltd PO-92001.batC:\Users\admin\AppData\Roaming\rpxETSofm.exeexecutable
MD5:BB602D6C1CA8D62EBB1EA09744B8E02F
SHA256:97229D650CF54226B86B7CD7ECE3EE0E0AE55AC35C883A53C4D8DF14C90937E7
5512WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb5512.918\Sichuan Procurement Co.Ltd PO-92001.batexecutable
MD5:BB602D6C1CA8D62EBB1EA09744B8E02F
SHA256:97229D650CF54226B86B7CD7ECE3EE0E0AE55AC35C883A53C4D8DF14C90937E7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
23
DNS requests
17
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.138:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1056
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1056
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5988
Sichuan Procurement Co.Ltd PO-92001.bat
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.138:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
69.192.161.161:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2112
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 23.48.23.138
  • 23.48.23.193
  • 23.48.23.194
  • 23.48.23.190
  • 23.48.23.192
  • 23.48.23.147
  • 23.48.23.139
  • 23.48.23.150
  • 23.48.23.145
whitelisted
www.microsoft.com
  • 69.192.161.161
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.31.73
  • 20.190.159.75
  • 40.126.31.3
  • 40.126.31.1
  • 40.126.31.2
  • 20.190.159.71
  • 40.126.31.71
  • 20.190.159.130
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
  • 51.124.78.146
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
geoplugin.net
  • 178.237.33.50
whitelisted

Threats

PID
Process
Class
Message
5988
Sichuan Procurement Co.Ltd PO-92001.bat
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
5988
Sichuan Procurement Co.Ltd PO-92001.bat
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 41
5988
Sichuan Procurement Co.Ltd PO-92001.bat
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Artifacts-2025-05-15_18-46-55Z.zip