Extracted

• • Target

    shereallyliketokissy9uuoisheismygirlfriendswholovesmetrulygo.hta

  • Size

    46KB

  • MD5

    05887835a99ba5b4c9af5be59cbd3666

  • SHA1

    c3354d324fd9abe310cb080d80ddd55b02785f92

  • SHA256

    cc7d77d7eaf78658e21a950213d1a21c9bc45b1ba279400cbd984468ee721d20

  • SHA512

    51af02d7eefdee5fa6e7d327575f137efa1af38037875c2141c37156b2bc10afabbdcd15cb0fd436ddce6d6ae55b896ff03702a3ca774fc8988f99a888af48da

  • SSDEEP

    96:IQtaPnLI1mIAvBIAhYcJfw3KwZYxxUunyklIAZBIA35xmIIASGjz:tta/MnAGAFwZYEAMAYASGjz

  Score

  10^/10

  defense_evasiondiscoveryexecutionremcosremotehostcollectionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook accounts

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2