Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
RFQ - URGENT REQUEST.r11
-
Size
814KB
-
Sample
230526-p973xsff29
-
MD5
ceb8d079f60c54cb91f3c250ce15b09c
-
SHA1
30fd99f72cf5d9d65fe8d0bdf0e2378e079a6755
-
SHA256
f8c1e632a1ad12cd10d48e67b7ec7d58b133a1e624ac39f77fe7b121562c8acc
-
SHA512
4edf1cfd877b94c4b75859f1e872480a94788e910c6fffb01bc0cb45d5ce40314568e1b0f1d6c0785a8ca67941dcc95ef76610e99710e64f6de7a7f94c31e9ce
-
SSDEEP
12288:CkTOe1kXbYfgVxathyVoVJtfCejl96l/htVgS0N/hXcFfOFFSoa1cSDAUmqDHemS:TrOXUfgVoyVCxjl9wRgNN5XcAzda1ZQt
Static task
static1
Behavioral task
behavioral1
Sample
RFQ - URGENT REQUEST.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
RFQ - URGENT REQUEST.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
remcos
SirMo
servermolink.ddns.net:9019
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
bin.exe
-
copy_folder
bin
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-ENJ179
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
RFQ - URGENT REQUEST.exe
-
Size
1.0MB
-
MD5
5203b7b950622cd099fd40468a8ce9e8
-
SHA1
f1f40707fd40bc961cd684ebd5274b47fa7d82b7
-
SHA256
fa25a9987997b5bb2ee76905f6d6a3c5583b6751edd5e720640d712b2b094205
-
SHA512
5c9f2b03815989a0722b305c5b660a577089d4aca26376dd38ddadacd5a8803ddced39439a6154e398837f989321a87c20df91452e328733a4a1543a8bebc075
-
SSDEEP
12288:5QLzsiTB2QwWL7vPpLlvRolNoyHTXijBvqHrS+0P82jQeDi2aWpxy7BZrX92gsla:OLzxxnPpLlGNlTXiYrS+0P8m958vg+
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-