Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

allegato_35.js

windows7-x64

10

allegato_35.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    allegato_35.js

  • Size

    4KB

  • Sample

    231127-ldppxsff3y

  • MD5

    28eccbb393ed8689497c2966337666df

  • SHA1

    2d4a2ea5d4252a84cd22854cdecc2092aac0c4c2

  • SHA256

    04e5b2ca6f0ed2eb8a36deaef7ec8a5ba5780aa07e133153eac2e120ffe41672

  • SHA512

    c01e9d9992ccf8e01476c9a81a604a50e683812820af44281209824c5aaee685913043e8b190f4000a63b41a1dcae744dc1b5118f0685ae799311218e5380f5b

  • SSDEEP

    96:TqKszBKK/HeX9vh7oUfCkHLlEjIhfOhjafVCz8TmA/sUHwFseGjtGjCDoUzk7/zx:TqK3K/+X9p7oUfCkHLlE8hfOhjafszEU

Score
10/10
remcosremotehostrat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

retghrtgwtrgtg.bounceme.net:3839

listpoints.click:7020

datastream.myvnc.com:5225

gservicese.com:2718

center.onthewifi.com:8118
Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    explorer.exe

  • delete_file

    false

  • hide_file

    true

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-OPX7KW

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      allegato_35.js

    • Size

      4KB

    • MD5

      28eccbb393ed8689497c2966337666df

    • SHA1

      2d4a2ea5d4252a84cd22854cdecc2092aac0c4c2

    • SHA256

      04e5b2ca6f0ed2eb8a36deaef7ec8a5ba5780aa07e133153eac2e120ffe41672

    • SHA512

      c01e9d9992ccf8e01476c9a81a604a50e683812820af44281209824c5aaee685913043e8b190f4000a63b41a1dcae744dc1b5118f0685ae799311218e5380f5b

    • SSDEEP

      96:TqKszBKK/HeX9vh7oUfCkHLlEjIhfOhjafVCz8TmA/sUHwFseGjtGjCDoUzk7/zx:TqK3K/+X9p7oUfCkHLlE8hfOhjafszEU

    Score
    10/10
    remcosremotehostrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.