Extracted

• • Target
    Purchase Order Specifications 2024.bat
  • Size 891KB
  • SHA256 f486a970c3228b346008eb169500d373560ea047084818b77357ba68bfa960af
  • MD5 365611c6c550f6b4d41e017b7f658975
  • SHA1 b31644d9fb613abfcb0bf7a801db77b4d7fd7ec9
  • SHA512 6393bd06d1ea7faaccc85469f6b87aaab102064c8871f6ea8c33ea5434d822ddbd59157e50def89219ee0d3ebe09d34423dfc5d23f337b42a134422d71c3f721
  • SSDEEP 24576:Ig5HJmx9NoiP7+J7v8Dlco1AtasmkDu13xXD7:1Jmx/7zYv8BJ4a1kq1R7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  remcosremotehostcollectionratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Detects executables built or packed with MPress PE compressor

  • Detects executables packed with SmartAssembly

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2