Resubmissions
19-11-2024 14:41
241119-r2m4wsxjdx 10General
-
Target
formulario_agendamiento_citas.zip
-
Size
5.1MB
-
Sample
241119-r2m4wsxjdx
-
MD5
8e5db6be930c6bc7b2133fd036b6f85c
-
SHA1
7e12aa3ea98b78bffc45d077cf5df4075e233355
-
SHA256
b324e4dea8b775410803a54be3c7c5a2009c1065e3fe818588fe2f73bc12599f
-
SHA512
8e5bd411b5ee8c11db072e228c0c07e5c9089c207709412cebc5cb9cb4aa2f563cf3a55db0c31deee2c9f2b1bd4a495d3b4d0305d181ffcc33a3681b5ad01620
-
SSDEEP
98304:xWLoaTzq2dT1u6auWzQXJTnEStqAHIBdFpYYOAaIhdD87LrmnU:EEYzVV10HzAJjEzAHIbFpJOAaktYXmnU
Static task
static1
Behavioral task
behavioral1
Sample
formulario_agendamiento_citas.msi
Resource
win11-20241007-es
Malware Config
Extracted
remcos
NOVIEMBRE 13 MUCHACHA
imaxatmonk.imaxatmonk.com:2204
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
Acobatlg.exe
-
copy_folder
edqelofh
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
vlitanhs
-
mouse_option
false
-
mutex
necoclior-AOS1YP
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
formulario_agendamiento_citas.msi
-
Size
5.1MB
-
MD5
b0b0ce5887fe4e050976eb7b6dcca652
-
SHA1
f1b214aa8d48ed152dfe93e897b871751363f0c2
-
SHA256
8e6981d8311dae27119abc5f7a20989372cae47881f7c746c880decef4dfc3b3
-
SHA512
611344cc69e0560684cf65f94f243a7402c769e8668a15c9a3eda12ca61839c765612bc10ba812e11163fd6de4fdb0b105210d8065d241f40b4a732268007c40
-
SSDEEP
98304:6ZR9azHni3R3ousBqztSdq0doM+a76WmUydgul2bajywVmBTfnCAwvnZJ:6ZnaiG3Bq5UPRrul4imRnClv
-
Remcos family
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext
-