Extracted

Extracted

• • Target

    na.hta

  • Size

    129KB

  • MD5

    b256926cd54c4c7a2a0f708d20d24217

  • SHA1

    6e4cdcfd55eb6b1b865a337e4197471e8df8d997

  • SHA256

    bf0cfe7666b1d511b4664b0589b2f4e50a11ebdee55fe32c9ca5238d11303cda

  • SHA512

    763e4679a28f7d6be17af3976ea018ebeeaba7e0ddaef210ca2d5ed510b44397e26cb132e72c62e20690b159400f0efaa3d65fc2bce953c2cc5ae4e98587ea43

  • SSDEEP

    48:7oagpd7Ah23jxgm6FXtIS/8m6FoltIS/1n0j+2xsmT599Ddao9aWIVUUXm6FLm6j:Eam7Ro/B/CjlvtfYo9JCVm3/eb7T

  Score

  10^/10

  defense_evasiondiscoveryexecutionremcoshiddenhostcollectionratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2