Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    file.exe

  • Size

    574KB

  • Sample

    231003-gvwgksad95

  • MD5

    69bf840d279bb17e387e74914a122af6

  • SHA1

    7c5e6a9c7107ed3ef251d5571ef2dd053165ec8d

  • SHA256

    343b2ad0290badf5ce4700a3b93866f63ef8157b157f09cb3c9da4f3efd1c1c2

  • SHA512

    6d374c7b929b3f52b1723e0a13e316a0d51e6fee43e949a3453b77b1d7a7e11018a5ae279996c004fa26f161115c331a96f0a1ef01725aa847ce292d18792d84

  • SSDEEP

    12288:V0obxAhh3kCS/ylnAjQSLhBPlyF1+SULR2NpT5R:hlAoiFSnlyFk1LR8pT5R

Malware Config

Extracted

Family

remcos

Botnet

Sammmmm

C2

185.225.74.166:1606

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-46ILKG

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      file.exe

    • Size

      574KB

    • MD5

      69bf840d279bb17e387e74914a122af6

    • SHA1

      7c5e6a9c7107ed3ef251d5571ef2dd053165ec8d

    • SHA256

      343b2ad0290badf5ce4700a3b93866f63ef8157b157f09cb3c9da4f3efd1c1c2

    • SHA512

      6d374c7b929b3f52b1723e0a13e316a0d51e6fee43e949a3453b77b1d7a7e11018a5ae279996c004fa26f161115c331a96f0a1ef01725aa847ce292d18792d84

    • SSDEEP

      12288:V0obxAhh3kCS/ylnAjQSLhBPlyF1+SULR2NpT5R:hlAoiFSnlyFk1LR8pT5R

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks