Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

4f87ea2f7b...eb.exe

windows7-x64

10

4f87ea2f7b...eb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb

  • Size

    2.2MB

  • Sample

    221122-jpf6tahh4z

  • MD5

    9f7d50137e6e95183c4d2a00489e78b7

  • SHA1

    c059ee047b9a808efc09d40f7cf9c90bdbd87f4e

  • SHA256

    4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb

  • SHA512

    1cf107f8526374280614075ef474708d2a432033c7c34d60b8b7e0c33c390dd670baa5f492a1105c8ca79e88858f687f8fb628d92c51440dae0b415e2f000774

  • SSDEEP

    12288:VPBxkfVOwE9dfLEazhIxRBtrGT3qOa2B9ARdn2VTudpOHjnWZQzjFeM6DJOjB9sT:rRwf0sqVTudpODnYQb6VOPOsMhaNI7

Score
10/10
remcosbankhostrat

Malware Config

Extracted

Family

remcos

Botnet

BankHost

C2

aryexpcrt.ddns.net:36225

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-S4O8S2

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb

    • Size

      2.2MB

    • MD5

      9f7d50137e6e95183c4d2a00489e78b7

    • SHA1

      c059ee047b9a808efc09d40f7cf9c90bdbd87f4e

    • SHA256

      4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb

    • SHA512

      1cf107f8526374280614075ef474708d2a432033c7c34d60b8b7e0c33c390dd670baa5f492a1105c8ca79e88858f687f8fb628d92c51440dae0b415e2f000774

    • SSDEEP

      12288:VPBxkfVOwE9dfLEazhIxRBtrGT3qOa2B9ARdn2VTudpOHjnWZQzjFeM6DJOjB9sT:rRwf0sqVTudpODnYQb6VOPOsMhaNI7

    Score
    10/10
    remcosbankhostrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks