Extracted

Extracted

• • Target

    na.hta

  • Size

    118KB

  • MD5

    3734b6b1d8a5b84814fa08ce7b1ef6c7

  • SHA1

    b89ece297f8abe5e32931f3589d572f50b5036a8

  • SHA256

    b2c7816147d7816cf870f2088aa7be410616f1b639214904a56e49e580c89580

  • SHA512

    add36444b8322aac9b7300081dd67a7d887427dd1d9d0c71115f1a2f4f9427e88b38b7c2158e715e6200fcc794d529611c9f4ac81c7ff10d86a9c996ac01ef8e

  • SSDEEP

    96:Eam73N7J8BZ7t8BIyEQ2XVVAfUFup/JJ5757N8BnL7i7T:Ea23N7u7nyEQUVA8cb757qL74T

  Score

  10^/10

  defense_evasiondiscoveryexecutionremcosauthurcollectionratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2