Extracted

• • Target

    08102024_1541_Beschwerde-Rechtsanwalt.vbs

  • Size

    11KB

  • MD5

    a7f87588bc5a6ad03f79fa3085be9d28

  • SHA1

    c79dd84cd67b0846050b112ab4ce4b8c2f70794d

  • SHA256

    5700a6ed9522d53708f6e93c1303b25bcd9ede837dc6a5c62f929db1a8d4a59c

  • SHA512

    00dfd74685a88acb05970cfed07e5edbb605419f1ca4d8c0703ecb5dd436ef8b729c25bc5316e188d80c762a2f5b4a68a4b61b4dea8d7f1a50f477e76695bd21

  • SSDEEP

    192:RXVmQSH8ZNUYCxEXHnas8BK1gF8ylvACz74VT4DNIO+LtbA/ziLrRtEpDCBMjd/8:11SIxC+X91gZ/+pwz3wb

  Score

  10^/10

  remcospeewe8646collectiondiscoveryexecutionpersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2