Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

tmp.exe

windows7-x64

10

tmp.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp

  • Size

    614KB

  • Sample

    230203-xclgnaca9s

  • MD5

    2dc355cbaeae404f2fed99736a82a517

  • SHA1

    5a956af57cdce69fc09811a5cfd12b20cb59ab82

  • SHA256

    1ef167a1328330c932ed31e21b40a0a9d00d3eb8b55a80925df68a2d5f4aaade

  • SHA512

    e814b6b8cab1f58a0b94dc6b28f6807f97fdf746866d743a0da97668d403223a405949c456454fddd6649af34663adc04b1554db28372630614143180ff25419

  • SSDEEP

    12288:+YA/vlQOY9MOfokgPFmwIqF0d2N8Pqu9yv4R2WEOLSuHv4:+YAXGOY9MOfokgdKq+S502DOLlw

Score
10/10
remcosfirst-sendpersistencerat

Malware Config

Extracted

Family

remcos

Botnet

First-Send

C2

top.not4abuse1.xyz:1558

sub.not4abuse1.xyz:1558
Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    rmcs

  • mouse_option

    false

  • mutex

    Rmc-4RNJ4J

  • screenshot_crypt

    false

  • screenshot_flag

    true

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    20

  • startup_value

    Remcos

  • take_screenshot_option

    true

  • take_screenshot_time

    5

  • take_screenshot_title

    Mail;Payment;Bank

Targets

    • Target

      tmp

    • Size

      614KB

    • MD5

      2dc355cbaeae404f2fed99736a82a517

    • SHA1

      5a956af57cdce69fc09811a5cfd12b20cb59ab82

    • SHA256

      1ef167a1328330c932ed31e21b40a0a9d00d3eb8b55a80925df68a2d5f4aaade

    • SHA512

      e814b6b8cab1f58a0b94dc6b28f6807f97fdf746866d743a0da97668d403223a405949c456454fddd6649af34663adc04b1554db28372630614143180ff25419

    • SSDEEP

      12288:+YA/vlQOY9MOfokgPFmwIqF0d2N8Pqu9yv4R2WEOLSuHv4:+YAXGOY9MOfokgdKq+S502DOLlw

    Score
    10/10
    remcosfirst-sendpersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks