Extracted

• • Target

    Customer Advisory - HS Code - Maersk Shipping.doc.exe

  • Size

    1.1MB

  • MD5

    f6e5eb4e11b2cee3a7d8636420159a32

  • SHA1

    e292b118a6a0638ff424c7afba5cf1ee0ac02fa5

  • SHA256

    bbf1e3e1b2b96e199380fc3cd959feb6c47f5c5aa9bdb034020d4051641f2117

  • SHA512

    5084b96c16942477add0e2778cc6e3578b30b7c148f7264d2daa7e8ee77f38ba4dc62480865964e4afe039ed33e6fe4686bff93f86b3760b89bf61babf1187dc

  • SSDEEP

    24576:b6G5oq6WlY5EQJbBCt598PkfzGwWPEXyq9:bPQrJChIP1q

  Score

  10^/10

  remcosfmglobalcollectionpersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2