General
-
Target
Factura Serfinanza095207277561125631669632022.exe
-
Size
179KB
-
Sample
210423-4yftkmndl2
-
MD5
289184d1dd4eea5bcac7d4d2a6441ea7
-
SHA1
8714529d874e8928fdcc10c968587c9755a60e12
-
SHA256
d5da11c22f87af583d01eb5f0f1afb6c7e471659b9736a4c80745a082f2ffe37
-
SHA512
9c2d1e9b80925b9e91b5361cf305828a117d652eebe1c122434b1e0c831f382a262cd8449acc66f40efe51ed5b6d44bd3d63f6b709b8666161e040ba45745670
Static task
static1
Behavioral task
behavioral1
Sample
Factura Serfinanza095207277561125631669632022.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Factura Serfinanza095207277561125631669632022.exe
Resource
win10v20210410
Malware Config
Extracted
remcos
databasepropersonombrecomercialideasearchwords.services:3521
Targets
-
-
Target
Factura Serfinanza095207277561125631669632022.exe
-
Size
179KB
-
MD5
289184d1dd4eea5bcac7d4d2a6441ea7
-
SHA1
8714529d874e8928fdcc10c968587c9755a60e12
-
SHA256
d5da11c22f87af583d01eb5f0f1afb6c7e471659b9736a4c80745a082f2ffe37
-
SHA512
9c2d1e9b80925b9e91b5361cf305828a117d652eebe1c122434b1e0c831f382a262cd8449acc66f40efe51ed5b6d44bd3d63f6b709b8666161e040ba45745670
Score10/10-
Turns off Windows Defender SpyNet reporting
-
Nirsoft
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-