Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
c6eb58e6a7889ef27e38ebc6b3ab4220b2fdb9b7a804d2db760638a31eda2e51.exe
-
Size
1.2MB
-
Sample
240628-b68ndsxcmr
-
MD5
ea6b45fe18b512642b240c9d61ab8770
-
SHA1
7db4b9f46eb62ce6eff432b9ed7b41096a54bb6e
-
SHA256
c6eb58e6a7889ef27e38ebc6b3ab4220b2fdb9b7a804d2db760638a31eda2e51
-
SHA512
23d7f26e025e7d8d22cca4157e987ddcdcc0860a5755537928b1e7cd94ab4c6a036b86e074ac2b8132cdc3f9aa1c2a13fa07d18d1608cae426511d46314f5ce4
-
SSDEEP
24576:TwRuljp0v6U0SvpWTvCkV0uf5ZmH1OvVjPrCwb6:TwRId0vAvCkCua1sjD
Static task
static1
Behavioral task
behavioral1
Sample
c6eb58e6a7889ef27e38ebc6b3ab4220b2fdb9b7a804d2db760638a31eda2e51.exe
Resource
win7-20240221-en
Malware Config
Extracted
remcos
june8
64.188.26.202:1604
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
Vexploio.exe
-
copy_folder
Vexplo
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-LWI3MD
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
c6eb58e6a7889ef27e38ebc6b3ab4220b2fdb9b7a804d2db760638a31eda2e51.exe
-
Size
1.2MB
-
MD5
ea6b45fe18b512642b240c9d61ab8770
-
SHA1
7db4b9f46eb62ce6eff432b9ed7b41096a54bb6e
-
SHA256
c6eb58e6a7889ef27e38ebc6b3ab4220b2fdb9b7a804d2db760638a31eda2e51
-
SHA512
23d7f26e025e7d8d22cca4157e987ddcdcc0860a5755537928b1e7cd94ab4c6a036b86e074ac2b8132cdc3f9aa1c2a13fa07d18d1608cae426511d46314f5ce4
-
SSDEEP
24576:TwRuljp0v6U0SvpWTvCkV0uf5ZmH1OvVjPrCwb6:TwRId0vAvCkCua1sjD
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Accesses Microsoft Outlook accounts
-
Suspicious use of SetThreadContext
-