General
-
Target
CEC_Bon_de_plata.pdf.rar
-
Size
886KB
-
Sample
240807-qzzt8szakn
-
MD5
636742820541c06da19e77383195961f
-
SHA1
bf37f916f04aabe152f67d6d03b1663d5dbf4a4c
-
SHA256
63860907ae7e491dbfae51f384e3b028b79905625e71d2e46c775e6acf8561e8
-
SHA512
bf5f6304da6890fb09e7f551e2cb407fa3f346f250258d191b43eda7340e7527eace6a203c9960e3538830a571606644eb3a4ff798a9d3fc1d331a5a7cd8702e
-
SSDEEP
24576:ufHJ/H2XnlC416VqHiqNfYih5BETaVl6aMia:ip/HulCq/CqNVh0TaVl6aMB
Static task
static1
Behavioral task
behavioral1
Sample
CEC_Bon_de_plata.pdf.iso
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
CEC_Bon_de_plata.pdf.iso
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
CEC_Bon_de_plata.pdf.exe
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
CEC_Bon_de_plata.pdf.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
remcos
RemoteHost
212.162.149.42:7118
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-WYBPPO
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
CEC_Bon_de_plata.pdf.img
-
Size
1.5MB
-
MD5
04afc712e09dea2782d491a07da5abad
-
SHA1
72f16e8f3e7f9d491bf6c602b7dbddcc874a0094
-
SHA256
7ee6d74121c2d7d2c21542308bcb91afe949bde5b31cfff8c7d504f3fa24ee94
-
SHA512
6b6d7dcdebad8983ff482a71ff4e3771778f2e6374c975dffc90a9961e4fc82084bc3aee2fe04532f02b1ee6707346110d8ad57b320633be98a44f9218d2ab06
-
SSDEEP
24576:cB/7/pYTVfsv208sSNW4ztXHldRBinBOiG:A/7OMbIWmnd2BOiG
Score3/10 -
-
-
Target
CEC_Bon_de_plata.pdf.bat
-
Size
969KB
-
MD5
24781308181f7f22425faaac77451a3d
-
SHA1
c62bcf469e55bde9c964ce613d6941867304c597
-
SHA256
cb810150b6ce80f61a808726d5abfbf598239c2e8f260f83bc27d6be9488f45e
-
SHA512
887b1e416b9ddcef846dda4b6aef7978b98d96c18f96a0f2e0c6660cc0e40c852396e588ebe908a914d37b010751bbbe42db6d0e64f5d249e6f108080fbed498
-
SSDEEP
24576:OB/7/pYTVfsv208sSNW4ztXHldRBinBOiGJ:G/7OMbIWmnd2BOiGJ
Score10/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-