General
-
Target
OFICIO No 218 CITACION JUDICIAL SPOA 051726000328201980198.exe.bin
-
Size
1.4MB
-
Sample
240502-dgnb9sfa7x
-
MD5
7f668ad0262fca387912eac42fe0d1ad
-
SHA1
ed66322c57e35ae311e936bee30338fc1e5fa9cb
-
SHA256
5bf7b71e86df7325952c69689ad1be6461477848afb69cf76f3ecf58471b92b6
-
SHA512
2c8b68902102d47663d112d068a93ab9c1b24d9e1f1111e291e3db75605df7c13bc9cf6238fb26d8685e7483d79c90874522bb812baa29f02498c557d15c8946
-
SSDEEP
24576:LrCsGvc3I9PZ9pxsPfEPaXuDBFRlC08a8SLOXEjJUYK90SebGaFf1ZYZkLlK9:6sG03+VxsP8ZLlC08a82rU1PyhK9
Static task
static1
Behavioral task
behavioral1
Sample
OFICIO No 218 CITACION JUDICIAL SPOA 051726000328201980198.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
OFICIO No 218 CITACION JUDICIAL SPOA 051726000328201980198.exe
Resource
win10v2004-20240419-en
Malware Config
Extracted
remcos
22 ABRIL---2024444
7g378gd2udx98d23d.con-ip.com:5023
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-FHDUIF
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
OFICIO No 218 CITACION JUDICIAL SPOA 051726000328201980198.exe.bin
-
Size
1.4MB
-
MD5
7f668ad0262fca387912eac42fe0d1ad
-
SHA1
ed66322c57e35ae311e936bee30338fc1e5fa9cb
-
SHA256
5bf7b71e86df7325952c69689ad1be6461477848afb69cf76f3ecf58471b92b6
-
SHA512
2c8b68902102d47663d112d068a93ab9c1b24d9e1f1111e291e3db75605df7c13bc9cf6238fb26d8685e7483d79c90874522bb812baa29f02498c557d15c8946
-
SSDEEP
24576:LrCsGvc3I9PZ9pxsPfEPaXuDBFRlC08a8SLOXEjJUYK90SebGaFf1ZYZkLlK9:6sG03+VxsP8ZLlC08a82rU1PyhK9
Score10/10-
Adds Run key to start application
-
Suspicious use of NtCreateThreadExHideFromDebugger
-