Extracted

• • Target

    Awb_Tracking_App_original_invoice_bl_packinglist_shipment_29_09_2024_00000000000000000000.bat

  • Size

    637KB

  • MD5

    ff4eb87d1d1b7be863e3d3ebacabd016

  • SHA1

    d87f89c5bcc66d4861b8d4654cac9b5f50dda1d4

  • SHA256

    c427e3abb88e7f09b05e5bdf03a1b7e4a8dd938d22d310556f12f2a54d880da0

  • SHA512

    53ea12baf38f793011bdb026cbfda1c510b199e8a137537d82449939426c1b4748764bf050fff61aca89760d398f783a63a6c5478464584014e66fd8083ab558

  • SSDEEP

    12288:zNiR660vPkyuY/J/ptZA9h7z13KXGWj4XXdN6+:xu0Hkg/lLSlrWj4Xn6+

  Score

  10^/10

  discoveryexecutionremcosgimmewealthcollectionpersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Blocklisted process makes network request

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    Dumperfrernes/Multiversities.Bek

  • Size

    52KB

  • MD5

    9f75d1ca6c6a219e26ceea78a6f6b218

  • SHA1

    688f14dea57c5989cdb6b29d2d2f5d6a07a460ef

  • SHA256

    203ef2d3c9984cadb87801dc09f084acf7d6f078855ba6300c6e2da79d3a23e9

  • SHA512

    a337e7288f0ed129ae27357914af9af67080835c2b15cc1000566b39f3a30756b2d9e17c910429ecdda936a0e91608ceffa75725e4f5ef3efb1bf9e6b5b6666e

  • SSDEEP

    768:TgeATHJjJp/klueGBVitBbWB+L2HuuSz35oDFkkSNa9qzgZmuPECvGf72IxJdccu:TQTHLquH7iXo+Vuy3SoaoYuCCJ0cQTB

  Score

  8^/10

  executionpersistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4