Extracted

• • Target

    FILE_02042025 (1).bat

  • Size

    574B

  • MD5

    711bed0103f2668aa733a139fbb608f0

  • SHA1

    71e3a7df7486106b78cbc4f9331792426173f47f

  • SHA256

    381d189e3ab62d72bc33979be7d37dfb8435f69c455e598c4da8fef9f36e2418

  • SHA512

    2a4f4cb7738282b630974d7904a907109287c8f27d439114cd46a1d87e588f80e3aed2eb80b517605ee1d522d63a510b76a6f379542c9fafdc8cf061700662bc

  Score

  10^/10

  remcoshostcollectioncredential_accessdiscoveryexecutionpersistenceratstealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1