General
-
Target
Attached pdf.exe
-
Size
617KB
-
Sample
210330-x7l24elz72
-
MD5
83c9cee1f209ec02934e3895d5c51dfa
-
SHA1
2ba1dac5e2fef7a948b21efcc267b3096656cf68
-
SHA256
93e8c5b7f7c4b18efb1f1c09c5ad9c5d8782611b9417f19063cdd17f3cdd92ee
-
SHA512
2df5a3c0f01f3aed5dd1d1cee3ef30e99b0b7e5e1692c6818f720d6d00bcb2b23a56b2334422ae618a57ffe87ceab0c5b54d6d43bfd463e77956eaa3feb656a2
Static task
static1
Behavioral task
behavioral1
Sample
Attached pdf.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Attached pdf.exe
Resource
win10v20201028
Malware Config
Extracted
remcos
rem1.camdvr.org:2404
rem16.hopto.org:2404
rem1666.hopto.org:2404
rem16.camdvr.org:2404
remmusic.freeddns.org:2404
sunwap1.ddns.net:2404
Targets
-
-
Target
Attached pdf.exe
-
Size
617KB
-
MD5
83c9cee1f209ec02934e3895d5c51dfa
-
SHA1
2ba1dac5e2fef7a948b21efcc267b3096656cf68
-
SHA256
93e8c5b7f7c4b18efb1f1c09c5ad9c5d8782611b9417f19063cdd17f3cdd92ee
-
SHA512
2df5a3c0f01f3aed5dd1d1cee3ef30e99b0b7e5e1692c6818f720d6d00bcb2b23a56b2334422ae618a57ffe87ceab0c5b54d6d43bfd463e77956eaa3feb656a2
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-