Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

PEDIDO#140...24.exe

windows7-x64

3

PEDIDO#140...24.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    15052024_2340_15052024_PEDIDO#140404-AB2324.gz

  • Size

    1008KB

  • Sample

    240515-3nz23sab3z

  • MD5

    4136b1fb8b7f4603ad52d675edff5cb2

  • SHA1

    684a12ccc1588f47bf77dcdb75d782ca1cd127f7

  • SHA256

    4f20e2ea3367ba6193bd966e8282aa4b2c0d5047283543ac17382421465cd5b9

  • SHA512

    b8d2a94e3703d2051ce198be1737b78f0c78b691d26da23b2e08bee60ad4371df2ace99ec36522c2ee376e2018ee8692005237688cb6e5ec1b1f0ec73a64241e

  • SSDEEP

    24576:2wGETNvBs2HFO57u+7P7jsJLO2/aoaE+k3LBKUD8:2MxBs2HZ+r7jsJ//taE+k3L9D8

Score
10/10
remcoslogsscollectionevasionexecutionrattrojan

Malware Config

Extracted

Family

remcos

Botnet

LOGSS

C2

64.188.26.204:2404

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-5AMF0U

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      PEDIDO#140404-AB2324.exe

    • Size

      1.3MB

    • MD5

      5632476c595eec38bc4fdf29848521c0

    • SHA1

      d56e3c24341e207fe9cec9742a135df0a66796e4

    • SHA256

      fb9154259baeba38fcb25fae2d53b8b498a68d451478d067d04e849606f33c6e

    • SHA512

      c96e708b3b33d242be36c2e65a52d1f7da04b833aeddcd7e4e93dd136b92cff82bffca032fca40f3544809368ff86517c868db13110138bf17c423ac69045a80

    • SSDEEP

      24576:O4WXhHQqP1synFS5noo7971QJL8+Ra6uEwkvLBA03W:Ojd9P1syn/oR71QJZRNuEwkvLd3W

    Score
    10/10
    executionremcoslogsscollectionevasionrattrojan

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Accesses Microsoft Outlook accounts

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks