Extracted

• • Target

    31032025_1511_2025.02.222 n.ts შპს განსხვავებული.bat.zip

  • Size

    2KB

  • MD5

    7ed7b97e6d5792402abdc0a3633f6169

  • SHA1

    8f159a4779df68b13739eb82956db9a5fa755c9f

  • SHA256

    1d1936c34268498a226330a8a055359a28414f04126bd0c3a8c6e339492f2de8

  • SHA512

    5aa3835b214a48af20f276a2a8d94ffb10d659354e57751afbd450efa1e44f76c105458ecbbc830afef13832a3425cd2bf5b2ea72c4e67307651a280e8ada1a0

  Score

  3^/10

  discovery
  behavioral1behavioral10behavioral11behavioral2behavioral3behavioral4behavioral5behavioral6behavioral7behavioral8behavioral9

• • Target

    2025.02.222 n.ts შპს განსხვავებული.bat

  • Size

    3KB

  • MD5

    1db91aace1aac9f3e07036598aeaa98b

  • SHA1

    c8f4074759f0ea7eef262c36163db7868c6503f7

  • SHA256

    3d5032b506dcc1626efecbebb7f97ff8539200b6090fffa96ef6090d7082d249

  • SHA512

    9f5e409c1d48c3fddb13085949a4141962000fcf45614cf6feff841d6331adec33cfd95d9836761436e6fed4b87136d730396da9ac89c065fe76f264b5d98de4

  Score

  10^/10

  remcossendingcollectiondiscoveryexecutionpersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral12behavioral13behavioral14behavioral15behavioral16behavioral17behavioral18behavioral19behavioral20behavioral21behavioral22