General
-
Target
Factura Serfinanza_0296079315_661568_61612474042820568_45916442_20577348272646701_73141196223677_pdf.exe
-
Size
181KB
-
Sample
210423-576mb2x6he
-
MD5
06b2befd05d60d47183797b1e079b6e8
-
SHA1
8d1abaeb6d198014767384dc6594b28bea6d6e69
-
SHA256
1384907c30bf5d2185b80dfbc63359a50f087e87a5caa3c27edf8cb3a3a6d2d5
-
SHA512
e10fc2a9b28e27b129e1208412ac4596f8e1314da58b2c88dbc82d8ddda8f61e7d58b0c30e0df6ece364fd57747616373a4efdc8889980bcf097fca624046a83
Static task
static1
Behavioral task
behavioral1
Sample
Factura Serfinanza_0296079315_661568_61612474042820568_45916442_20577348272646701_73141196223677_pdf.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Factura Serfinanza_0296079315_661568_61612474042820568_45916442_20577348272646701_73141196223677_pdf.exe
Resource
win10v20210408
Malware Config
Extracted
remcos
databasepropersonombrecomercialideasearchwords.services:3521
Targets
-
-
Target
Factura Serfinanza_0296079315_661568_61612474042820568_45916442_20577348272646701_73141196223677_pdf.exe
-
Size
181KB
-
MD5
06b2befd05d60d47183797b1e079b6e8
-
SHA1
8d1abaeb6d198014767384dc6594b28bea6d6e69
-
SHA256
1384907c30bf5d2185b80dfbc63359a50f087e87a5caa3c27edf8cb3a3a6d2d5
-
SHA512
e10fc2a9b28e27b129e1208412ac4596f8e1314da58b2c88dbc82d8ddda8f61e7d58b0c30e0df6ece364fd57747616373a4efdc8889980bcf097fca624046a83
Score10/10-
Turns off Windows Defender SpyNet reporting
-
Nirsoft
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-