Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe
-
Size
997KB
-
Sample
221127-ke97ksgc8s
-
MD5
5be047c4918352d2c4e0b7b767442f49
-
SHA1
b1e516c00130153bb1e16168be84c192d37f70da
-
SHA256
8bd7c472ccc01bdc5bc39c49af563d4f17b283b61a9612d0048eda5510a1741f
-
SHA512
18d6f2134e76faacac43f644db391d15b3f2c43db829f3e4b876fca701d582e5ac028f1cecb6aba89115880bc482fdd4ea499c71db945d90b86fd86c53a7c03a
-
SSDEEP
24576:s+TdsTkf6lDpUVM7fMbzoHND3PwG3KNLctcRKX/N8I:xT2S6sGMb8HpwybtcRul
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
remcos
2.7.1 Pro
Evans
46.183.216.163:8107
127.0.0.1:8107
10.26.173.68:8107
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-EFXK55
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
wikipedia;solitaire;
Targets
-
-
Target
SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe
-
Size
997KB
-
MD5
5be047c4918352d2c4e0b7b767442f49
-
SHA1
b1e516c00130153bb1e16168be84c192d37f70da
-
SHA256
8bd7c472ccc01bdc5bc39c49af563d4f17b283b61a9612d0048eda5510a1741f
-
SHA512
18d6f2134e76faacac43f644db391d15b3f2c43db829f3e4b876fca701d582e5ac028f1cecb6aba89115880bc482fdd4ea499c71db945d90b86fd86c53a7c03a
-
SSDEEP
24576:s+TdsTkf6lDpUVM7fMbzoHND3PwG3KNLctcRKX/N8I:xT2S6sGMb8HpwybtcRul
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-