Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

49630168d2...dc.exe

windows7-x64

3

49630168d2...dc.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ccab8be1b5d0ec4ede3ecb02a9551180.bin

  • Size

    265KB

  • MD5

    12382ccb120abdd72fc05aa3368e7adc

  • SHA1

    ea0256c0c943ffac17a54bcb4278d87a37317440

  • SHA256

    365a7e6b041a733d992488fbd11d3a06ce19de1a94c11a16f5cc8f287b7c3011

  • SHA512

    5a71c13c8ed9bdf7e59b02ac71849e5215900c12cbf0087653e37bb9e0fe5796cb17cd1eb37dc877004387500677a50c0e587a1e304a3d53b14107cee4c1066d

  • SSDEEP

    6144:QgSterlLfMQy7GIyd44d2TeSyK16HcJ2B:bwulLkQyS+4L5q6H22B

Score
10/10
ezeiferemcos

Malware Config

Extracted

Family

remcos

Botnet

ezeife

C2

closen.kozow.com:2404

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-CDP1EM

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos family
    remcos
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • ccab8be1b5d0ec4ede3ecb02a9551180.bin
    .zip

    Password: infected

  • 49630168d264eaf442a51ac629b22598afb6d9e127a7c2313f5fa13be41c95dc.exe
    .exe windows:5 windows x86 arch:x86

    Password: infected

    1389569a3a39186f3eb453b501cfe688


    Headers

    Imports

    Sections

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.