Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec
-
Size
595KB
-
Sample
221124-fty1msec2w
-
MD5
414f4a3b05028be19e006ae2ba9182b6
-
SHA1
2a66efff8a0dfcf8d0ac247940b8f790c3c9d377
-
SHA256
c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec
-
SHA512
82491b4e7876aa3d4306f1fdde6838e93fa123e0b66df8e262275be3fc5b80565475651bcc39765240467b209ca099522afa602ec414ebd9ee5bcaa8dc8a9a44
-
SSDEEP
12288:Ongh/PsZ1DX/VDJ8rrvE4kynl6i6rJ49j9qkaxv:Ongh/PVU4kYqJK9qkC
Static task
static1
Malware Config
Extracted
remcos
1.7 Pro
Nov 24th
gcrozona.duckdns.org:6062
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
Microsoft Intel Audios.exe
-
copy_folder
Audio Microsoft File
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
true
-
install_flag
true
-
install_path
%WinDir%
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
Windows Display
-
keylog_path
%WinDir%
-
mouse_option
false
-
mutex
Windows Audio
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
Window Security Check
-
take_screenshot_option
true
-
take_screenshot_time
5
-
take_screenshot_title
Username;password;proforma;invoice;notepad
Targets
-
-
Target
c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec
-
Size
595KB
-
MD5
414f4a3b05028be19e006ae2ba9182b6
-
SHA1
2a66efff8a0dfcf8d0ac247940b8f790c3c9d377
-
SHA256
c09cb187ead292e38f9552449115d0e8ad5211f65cd6cc2ad2a2e8249d7481ec
-
SHA512
82491b4e7876aa3d4306f1fdde6838e93fa123e0b66df8e262275be3fc5b80565475651bcc39765240467b209ca099522afa602ec414ebd9ee5bcaa8dc8a9a44
-
SSDEEP
12288:Ongh/PsZ1DX/VDJ8rrvE4kynl6i6rJ49j9qkaxv:Ongh/PVU4kYqJK9qkC
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-