Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
963c914d288dcc6fd4be76a109feecfe6ade32cb802ef799affed99c39f7185f_payload.exe
-
Size
482KB
-
Sample
240528-mbx4ysfc7y
-
MD5
e061f0c3a1fc124de1ff7e6dd44e6da7
-
SHA1
a17fa68fef483ae910661e06c0f83d298e70fe15
-
SHA256
86f196e6db84218ec0cb4ead59880352b3dfa01d74af93af60347883632f2bf3
-
SHA512
02ec6180f41701e27fb90f32a0294352f9739f186b7a16521d0599f90ae31e28fea82370d7dafd943f915035852a8018b8be88b95374ae607889a0b01333dab8
-
SSDEEP
6144:8XIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcN95Gv:8X7tPMK8ctGe4Dzl4h2QnuPs/ZDAcv
Behavioral task
behavioral1
Sample
963c914d288dcc6fd4be76a109feecfe6ade32cb802ef799affed99c39f7185f_payload.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
963c914d288dcc6fd4be76a109feecfe6ade32cb802ef799affed99c39f7185f_payload.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
remcos
RemoteHost
kelvin654.duckdns.org:14563
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-0E35XZ
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
963c914d288dcc6fd4be76a109feecfe6ade32cb802ef799affed99c39f7185f_payload.exe
-
Size
482KB
-
MD5
e061f0c3a1fc124de1ff7e6dd44e6da7
-
SHA1
a17fa68fef483ae910661e06c0f83d298e70fe15
-
SHA256
86f196e6db84218ec0cb4ead59880352b3dfa01d74af93af60347883632f2bf3
-
SHA512
02ec6180f41701e27fb90f32a0294352f9739f186b7a16521d0599f90ae31e28fea82370d7dafd943f915035852a8018b8be88b95374ae607889a0b01333dab8
-
SSDEEP
6144:8XIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcN95Gv:8X7tPMK8ctGe4Dzl4h2QnuPs/ZDAcv
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-