Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

41cc93f0e2...32.exe

windows7-x64

41cc93f0e2...32.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    41cc93f0e27a97c5a5d6b0e5518fefb39d4cd00e3d8d1c6dc7a84c019099e532

  • Size

    469KB

  • MD5

    07b3653e412ef63f2fccef7b404197e8

  • SHA1

    a5b8e29f8b6bbf1e10ab049083b0f214e958edfe

  • SHA256

    41cc93f0e27a97c5a5d6b0e5518fefb39d4cd00e3d8d1c6dc7a84c019099e532

  • SHA512

    dc088419aa3c9fb47d0ed7f318f44d51f84e82525c215ebd66ffc9c68b30410b02c38af4363e4a75838124c57e45f2c7fcad222def30a688d21f90d053696a97

  • SSDEEP

    12288:umnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSwn9:WiLJbpI7I2WhQqZ7w9

Score
10/10
remotehostremcos

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

accessories-retrieve.gl.at.ply.gg:9999

accessories-retrieve.gl.at.ply.gg:13970
Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    true

  • hide_file

    true

  • hide_keylog_file

    false

  • install_flag

    true

  • install_path

    %WinDir%\System32

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-GWSYNB

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos family
    remcos
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 41cc93f0e27a97c5a5d6b0e5518fefb39d4cd00e3d8d1c6dc7a84c019099e532
    .exe windows:5 windows x86 arch:x86

    5d354883fe6f15fcf48045037a99fb7a


    Headers

    Imports

    Sections

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.