Extracted

Extracted

Extracted

• • Target
    Pedido 202510130ESPA.pdf.exe
  • Size 698KB
  • SHA256 829fad413d5103822bc05f8cbf726203d8a57be3da077e0deaa3a901b6be1efa
  • MD5 9898b1c4dd84e3820c2a0dd239e204be
  • SHA1 c865d8e2212b7f111d72f2b295061fe7f0a7baa3
  • SHA512 fa9f609e167d85cd912c0ce31be68389d626f574becef0a8b8af796c44d174194a43fb7a956ac5584598a29ca958c843a59f7b4f4ecadc7617b95eb68acb86f3
  • SSDEEP 12288:2ArMDSNgFd/GxkAlJX5kcu+FdX1uxwWFEJqqvqHC54:lFgb/GiAljl1uxwWAqZw4
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  es xwormcollectioncrypterdefense_evasiondiscoverydarkclouddarktortillaremcosxwormloaderpersistenceratspywarestealertrojan

  • DarkCloud

    An information stealer written in Visual Basic.

    stealerdarkcloud

  • Darkcloud family

    darkcloud

  • Darktortilla

    DarkTortilla is a highly configurable .NET based crypter that delivers a wide range of information stealers.

    loadercrypterdarktortilla

  • Darktortilla family

    darktortilla

  • Detect Xworm Payload

  • Detects Darktortilla crypter.

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2