Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    midyear_statement.exe

  • Size

    1.2MB

  • Sample

    240328-p7g4qafg82

  • MD5

    dd8e3f6ac5c24960b3a69490082c60e1

  • SHA1

    c5f8aaec5baa571791789dd5fac53e27938dbc29

  • SHA256

    15db18392d7bbf15b30e528db05ec306e00ac3227277d0639064ec3e2bc98c73

  • SHA512

    ac96e6fb368f5e2c8b8a80eb32635357f1931838b8575125956fe2e3c2465b7bd228606635f3563bb0a047b3bc8fbd19d25e0609210c4574c05993ec078ad205

  • SSDEEP

    12288:evGkW/sci4Vup7XNihvMHH59TpfLFhLme7iEEEblTHQE1ZEQrfvAcEH+DwxTe8g:e+Rg+up7XNiyHZ994eHQEQahz

Malware Config

Extracted

Family

remcos

Botnet

vista

C2

www.zuckdgreb.duckdns.org:4445

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-W5UGP5

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      midyear_statement.exe

    • Size

      1.2MB

    • MD5

      dd8e3f6ac5c24960b3a69490082c60e1

    • SHA1

      c5f8aaec5baa571791789dd5fac53e27938dbc29

    • SHA256

      15db18392d7bbf15b30e528db05ec306e00ac3227277d0639064ec3e2bc98c73

    • SHA512

      ac96e6fb368f5e2c8b8a80eb32635357f1931838b8575125956fe2e3c2465b7bd228606635f3563bb0a047b3bc8fbd19d25e0609210c4574c05993ec078ad205

    • SSDEEP

      12288:evGkW/sci4Vup7XNihvMHH59TpfLFhLme7iEEEblTHQE1ZEQrfvAcEH+DwxTe8g:e+Rg+up7XNiyHZ994eHQEQahz

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • ModiLoader Second Stage

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.