Extracted

• • Target

    Zamówienie Agotech Begyndelsesord.cmd

  • Size

    6KB

  • MD5

    3d7da4151a900b78806ab477742d5dac

  • SHA1

    6c1e6242135295dd5fa581f985691e6e83a578c0

  • SHA256

    18c0a772f0142bc8e5fb0c8931c0ba4c9e680ff97d7ceb8c496f68dea376f9da

  • SHA512

    8a1ab4409d25356a3b7f2a491360e4522903a9fde8e8f08a1bb2e2374e69d2a46ece3f928c5048800f55e3000b7cc8011004a9ef1dc9bc6fc816f35fce7ca6b2

  • SSDEEP

    96:TMYZqpZ6iOlYvwLIcwlzQ5yMNPRhA+aNukrQd5QcEzprsQh47ETwC28iD0yc:T/q76iOlKwWINPsj+Zers57ETwC28eVc

  Score

  10^/10

  remcosmiss chydiscoveryexecutionpersistenceratcollection

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4