Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

26d1beca61...ad.exe

windows7-x64

10

26d1beca61...ad.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    26d1beca6157aa1ea3ba22dfe6ed8bad

  • Size

    697KB

  • Sample

    231231-ea3ztaedd8

  • MD5

    26d1beca6157aa1ea3ba22dfe6ed8bad

  • SHA1

    36838403ed23cc30c7294b5fc6d34045e8aa889d

  • SHA256

    e9347ac566eadef7764b0d50c64ca06561171f30392b1d37d1ee8cdde6c0b145

  • SHA512

    7e7832161497a3a78fde2636ec065761494ed753a7ecb405db2bc79b652a1077fc2a20fa04b28542d183b3004c9523a3ed7d24bbf697f4a6430a92f383d559f0

  • SSDEEP

    12288:/a4uMk2dgCRi4/OMhaHYD4zfTx+wFjd1g2iN:/aG4jMhaHYDWV+Qbg1

Score
10/10
remcoshostpersistencerat

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

C2

swrypaiii.ydns.eu:8976

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    remcos.exe

  • copy_folder

    remcos

  • delete_file

    false

  • hide_file

    true

  • hide_keylog_file

    false

  • install_flag

    true

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    remcos_xawtetfkrdejvrj

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screens

  • screenshot_path

    %AppData%

  • screenshot_time

    1

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      26d1beca6157aa1ea3ba22dfe6ed8bad

    • Size

      697KB

    • MD5

      26d1beca6157aa1ea3ba22dfe6ed8bad

    • SHA1

      36838403ed23cc30c7294b5fc6d34045e8aa889d

    • SHA256

      e9347ac566eadef7764b0d50c64ca06561171f30392b1d37d1ee8cdde6c0b145

    • SHA512

      7e7832161497a3a78fde2636ec065761494ed753a7ecb405db2bc79b652a1077fc2a20fa04b28542d183b3004c9523a3ed7d24bbf697f4a6430a92f383d559f0

    • SSDEEP

      12288:/a4uMk2dgCRi4/OMhaHYD4zfTx+wFjd1g2iN:/aG4jMhaHYDWV+Qbg1

    Score
    10/10
    remcoshostpersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks