Extracted

• • Target

    2025.02.222 n.ts შპს განსხვავებული.bat

  • Size

    3KB

  • MD5

    1db91aace1aac9f3e07036598aeaa98b

  • SHA1

    c8f4074759f0ea7eef262c36163db7868c6503f7

  • SHA256

    3d5032b506dcc1626efecbebb7f97ff8539200b6090fffa96ef6090d7082d249

  • SHA512

    9f5e409c1d48c3fddb13085949a4141962000fcf45614cf6feff841d6331adec33cfd95d9836761436e6fed4b87136d730396da9ac89c065fe76f264b5d98de4

  Score

  10^/10

  remcossendingcollectiondiscoveryexecutionpersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1