Extracted

• • Target
    z12025-D1-05181NoluDiib-Revize.bat
  • Size 6KB
  • SHA256 d012a92e43408d373db49ebc99461bf4dbbbd0ab1f7d07d0f96650ea849ac147
  • MD5 454c6ef6f477a4b3a6106f0c4e5a8bce
  • SHA1 d13d7c1d773d08e83889e3bc18ca3dbd5af0be76
  • SHA512 188fe4c0d6e142111e563c6b1db42f078e22f3ad4dc76b6e48f761ad641e22135b654bff7331a4b56c48518cccfdb38ec97ca3cf231b4ce4359d8e690086eaa6
  • SSDEEP 192:JcjL6VTN0/wCE+f52qUiqqvWsi+VCXViOEbkCB5AWy:JYLQTQp2J8+sPcltoRXy
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectiondiscoveryexecutionremcosrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2