Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

Purchase O...09.cmd

windows7-x64

7

Purchase O...09.cmd

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Purchase Order is approved20240509.cmd

  • Size

    2.4MB

  • Sample

    240510-jvdymsbg3t

  • MD5

    fe393a407b85b37633f9c2dc593801b4

  • SHA1

    ab6c1cc6fdc415738b74214db52d9805166a727b

  • SHA256

    574f194754022d9834c8d1a4c4013c25ef678e3d36b39238f9583bab7d745dc8

  • SHA512

    2a72142927ef087b47c3f3e3d80db96595b577aec50d6fff2ab57e4e434dfb9aa54fe2d37213e8d8b414340b6878365adfa29db4e75f6094d4698c60b92adf3f

  • SSDEEP

    49152:Xgx8XXdStPR/FS/ncG6aoiQUiujLb5DxUaeNFWoqMr:g

Score
10/10
remcosnewremotehost-aprilfilepersistencerat

Malware Config

Extracted

Family

remcos

Botnet

NEWRemoteHost-APRILFILE

C2

www.pentegrasystem.com:9231

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-3A6IQD

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      Purchase Order is approved20240509.cmd

    • Size

      2.4MB

    • MD5

      fe393a407b85b37633f9c2dc593801b4

    • SHA1

      ab6c1cc6fdc415738b74214db52d9805166a727b

    • SHA256

      574f194754022d9834c8d1a4c4013c25ef678e3d36b39238f9583bab7d745dc8

    • SHA512

      2a72142927ef087b47c3f3e3d80db96595b577aec50d6fff2ab57e4e434dfb9aa54fe2d37213e8d8b414340b6878365adfa29db4e75f6094d4698c60b92adf3f

    • SSDEEP

      49152:Xgx8XXdStPR/FS/ncG6aoiQUiujLb5DxUaeNFWoqMr:g

    Score
    10/10
    remcosnewremotehost-aprilfilepersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks