Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb
-
Size
2.2MB
-
Sample
221122-jpf6tahh4z
-
MD5
9f7d50137e6e95183c4d2a00489e78b7
-
SHA1
c059ee047b9a808efc09d40f7cf9c90bdbd87f4e
-
SHA256
4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb
-
SHA512
1cf107f8526374280614075ef474708d2a432033c7c34d60b8b7e0c33c390dd670baa5f492a1105c8ca79e88858f687f8fb628d92c51440dae0b415e2f000774
-
SSDEEP
12288:VPBxkfVOwE9dfLEazhIxRBtrGT3qOa2B9ARdn2VTudpOHjnWZQzjFeM6DJOjB9sT:rRwf0sqVTudpODnYQb6VOPOsMhaNI7
Static task
static1
Behavioral task
behavioral1
Sample
4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe
Resource
win7-20221111-en
Malware Config
Extracted
remcos
BankHost
aryexpcrt.ddns.net:36225
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-S4O8S2
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb
-
Size
2.2MB
-
MD5
9f7d50137e6e95183c4d2a00489e78b7
-
SHA1
c059ee047b9a808efc09d40f7cf9c90bdbd87f4e
-
SHA256
4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb
-
SHA512
1cf107f8526374280614075ef474708d2a432033c7c34d60b8b7e0c33c390dd670baa5f492a1105c8ca79e88858f687f8fb628d92c51440dae0b415e2f000774
-
SSDEEP
12288:VPBxkfVOwE9dfLEazhIxRBtrGT3qOa2B9ARdn2VTudpOHjnWZQzjFeM6DJOjB9sT:rRwf0sqVTudpODnYQb6VOPOsMhaNI7
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-