Extracted

• • Target

    rEXSP5634HISP9005STMSDSDOKUME74247linierelet.bat

  • Size

    5KB

  • MD5

    e6e618c4354c26c555872d5398a72086

  • SHA1

    76cddb6019c5d76a96de461a85742d766feebca8

  • SHA256

    e0d9ebe414aca4f6d28b0f1631a969f9190b6fb2cf5599b99ccfc6b7916ed8b3

  • SHA512

    0251b7c4f32ad218628d5e71bd80f909e4c124420e47e434b622e280253189e615206d6f6846ac63d66af14500054f38b15f473f5725b541c6921c03e23fea87

  • SSDEEP

    96:/ZAmDvLJYo/4xtgIYzTSWteyhFeeOFXsQOEPoxFft7K3/XG3gWTE:amDzafszOaNCXPOkYjKPQgWI

  Score

  10^/10

  remcosmiss chydiscoveryexecutionpersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Adds Run key to start application

    persistence

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2