Extracted

• • Target

    Customer Advisory - HS Code - Maersk Shipping.ppt.exe

  • Size

    947KB

  • MD5

    23f0cf81aa7d1c7a4a23e95e5a2595e4

  • SHA1

    0e477abeb86ae366d906a247e8f30b4ccdc02eef

  • SHA256

    a135b28345728e0533bf4bdad442dfee04d2e6f67e9b04ebb088919ef18d6601

  • SHA512

    208db7a72859d78a9b9ee235f78ae55b3fbc05fec9c475c5aaf66ffd50e4d9c16d58620473a21ffd0c19874b4906f9c0b7b1e77b6bd22f9cf87789ad3d4ab0e9

  • SSDEEP

    24576:/YTyQ+R2J+E34ppWnRM/ggnlWWf5tlD7k:/pbkJqbMWBtN

  Score

  10^/10

  remcosfmglobalcollectionpersistenceratspywarestealer

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2