Extracted

Extracted

• • Target

    newthingtobeonlinefor.hta

  • Size

    117KB

  • MD5

    02db2924d9d28415909466fd83d98bfb

  • SHA1

    131f37687d5f92227dbf8db85537d8d588ba4c67

  • SHA256

    63460bd959db60a47de9dfbc64c58abd983af187b29d7732987928c56a83a2e1

  • SHA512

    7b7bec8c6f697b048d87e2af22e704caf7a2c05fdb1331e99d13d5baf0f5c625cf574d16c596d2dbb000b829bdb752437801c8bb833ed7e62dd1ae3f4c14d9f5

  • SSDEEP

    96:Ea+M7+XoPsV9oPpF/4Ow5qouNREOX8MlV5BYoPItl8AT:Ea+Q+XoPsPoPX/4J54E3cqoPi9T

  Score

  10^/10

  defense_evasiondiscoveryexecutionremcosremotehostcollectionratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2