Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
26d1beca6157aa1ea3ba22dfe6ed8bad
-
Size
697KB
-
Sample
231231-ea3ztaedd8
-
MD5
26d1beca6157aa1ea3ba22dfe6ed8bad
-
SHA1
36838403ed23cc30c7294b5fc6d34045e8aa889d
-
SHA256
e9347ac566eadef7764b0d50c64ca06561171f30392b1d37d1ee8cdde6c0b145
-
SHA512
7e7832161497a3a78fde2636ec065761494ed753a7ecb405db2bc79b652a1077fc2a20fa04b28542d183b3004c9523a3ed7d24bbf697f4a6430a92f383d559f0
-
SSDEEP
12288:/a4uMk2dgCRi4/OMhaHYD4zfTx+wFjd1g2iN:/aG4jMhaHYDWV+Qbg1
Static task
static1
Behavioral task
behavioral1
Sample
26d1beca6157aa1ea3ba22dfe6ed8bad.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
26d1beca6157aa1ea3ba22dfe6ed8bad.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
remcos
1.7 Pro
Host
swrypaiii.ydns.eu:8976
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
remcos_xawtetfkrdejvrj
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
26d1beca6157aa1ea3ba22dfe6ed8bad
-
Size
697KB
-
MD5
26d1beca6157aa1ea3ba22dfe6ed8bad
-
SHA1
36838403ed23cc30c7294b5fc6d34045e8aa889d
-
SHA256
e9347ac566eadef7764b0d50c64ca06561171f30392b1d37d1ee8cdde6c0b145
-
SHA512
7e7832161497a3a78fde2636ec065761494ed753a7ecb405db2bc79b652a1077fc2a20fa04b28542d183b3004c9523a3ed7d24bbf697f4a6430a92f383d559f0
-
SSDEEP
12288:/a4uMk2dgCRi4/OMhaHYD4zfTx+wFjd1g2iN:/aG4jMhaHYDWV+Qbg1
Score10/10-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-