Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

RFQ - URGE...ST.exe

windows7-x64

10

RFQ - URGE...ST.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RFQ - URGENT REQUEST.r11

  • Size

    814KB

  • Sample

    230526-p973xsff29

  • MD5

    ceb8d079f60c54cb91f3c250ce15b09c

  • SHA1

    30fd99f72cf5d9d65fe8d0bdf0e2378e079a6755

  • SHA256

    f8c1e632a1ad12cd10d48e67b7ec7d58b133a1e624ac39f77fe7b121562c8acc

  • SHA512

    4edf1cfd877b94c4b75859f1e872480a94788e910c6fffb01bc0cb45d5ce40314568e1b0f1d6c0785a8ca67941dcc95ef76610e99710e64f6de7a7f94c31e9ce

  • SSDEEP

    12288:CkTOe1kXbYfgVxathyVoVJtfCejl96l/htVgS0N/hXcFfOFFSoa1cSDAUmqDHemS:TrOXUfgVoyVCxjl9wRgNN5XcAzda1ZQt

Score
10/10
remcossirmopersistencerat

Malware Config

Extracted

Family

remcos

Botnet

SirMo

C2

servermolink.ddns.net:9019

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    bin.exe

  • copy_folder

    bin

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    true

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-ENJ179

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      RFQ - URGENT REQUEST.exe

    • Size

      1.0MB

    • MD5

      5203b7b950622cd099fd40468a8ce9e8

    • SHA1

      f1f40707fd40bc961cd684ebd5274b47fa7d82b7

    • SHA256

      fa25a9987997b5bb2ee76905f6d6a3c5583b6751edd5e720640d712b2b094205

    • SHA512

      5c9f2b03815989a0722b305c5b660a577089d4aca26376dd38ddadacd5a8803ddced39439a6154e398837f989321a87c20df91452e328733a4a1543a8bebc075

    • SSDEEP

      12288:5QLzsiTB2QwWL7vPpLlvRolNoyHTXijBvqHrS+0P82jQeDi2aWpxy7BZrX92gsla:OLzxxnPpLlGNlTXiYrS+0P8m958vg+

    Score
    10/10
    remcossirmopersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks