General
-
Target
94a6db989c7b1e1ef9e3331171eb4c2c.rar
-
Size
943KB
-
Sample
241018-s7rvpsvdpb
-
MD5
94a6db989c7b1e1ef9e3331171eb4c2c
-
SHA1
7ef28db7f05d338055fea44ffb8ed15503c9ee35
-
SHA256
6456825e433ad5aee331a9f3b45c29d0dd4404b67ab2264cf51755d040a1d372
-
SHA512
6ac9ce8249c4cdca0f3b2c90f80ae8c1fda8bfcc7a637a6650930476030dfb5be9e01feaf6184237b87ca37cacab5915bbacc9615c932fd58e58305b9ff77898
-
SSDEEP
24576:Ia5SLUksEHS4JImyRSnOjEpJwLi0OWinU7r7J/:Ia5UXsEkEPUUWinUbl
Static task
static1
Behavioral task
behavioral1
Sample
ACTO ADMINISTRATIVO No. 0216_SANCIÓN POR RESOLUCIÓN.pdf.exe
Resource
win7-20240903-en
Malware Config
Extracted
asyncrat
| CRACKED BY https://t.me/xworm_v2
MAXIMO9
delonuevomision.con-ip.com:2625
tempcookiee
-
delay
3
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
ACTO ADMINISTRATIVO No. 0216_SANCIÓN POR RESOLUCIÓN.pdf.exe
-
Size
971KB
-
MD5
a6aca7334109f9557e4e36bcb0636db9
-
SHA1
0d48af64ab4ec6d5df3c3a3fd2e5d44ab63f1ad4
-
SHA256
8adc74379b29818e3185b0e289a1bf15c23c5974b99bbeb73b2155e17fcb1c35
-
SHA512
4247c3b5b782c7dd46bbfec37e805a35a3e982254754b6d7fe0d7c7abdc573f06dcef4dae6516b14278df7e8f0cc989e29d4b5907071cc7f8e8e019aff5f2e6d
-
SSDEEP
24576:HGOm0UBEP0ucza/1IEzmyKSacHha7FZ5tHpVdbGIP1vn8nwm5vK:+y8utGx0ha7FZ5tHpVdd9Ewm5vK
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Drops startup file
-
Suspicious use of SetThreadContext
-