Extracted

• • Target

    Products details_1.docx.doc

  • Size

    410KB

  • MD5

    f155a645b4eabe0b888a878c50d15d6f

  • SHA1

    bb0b7e4b7e1b0dd7e2a1fa4e212444c2257608bc

  • SHA256

    c15de07fb429eb91998849e4d2ae5c0f6f2a4ee67a989040bedb23a3480bc49a

  • SHA512

    9c8288b506d04f647f5883b832528fc72c6dbaa40830391a2a687a5c01e4e55b5e55aa6853849fc3e2ca6cd94dce582a1f108ca048870f7b0bc0be6fede13e07

  • SSDEEP

    6144:O/46IXsfkfhfjf0Q5OBfif1fAfKFO6S951ndPJQf2fJa:OgcfkfhfjfrOBfif1fAfK4h1dPmf2fI

  Score

  10^/10

  remcosremotehostcollectionexecutionpersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Abuses OpenXML format to download file from external location

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2