Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

21/09/2024, 23:17 UTC

240921-292mcszcnl 10

21/09/2024, 23:07 UTC

240921-23yxwsyhqp 10

General

  • Target

    Quotationpdf.exe

  • Size

    869KB

  • Sample

    240921-23yxwsyhqp

  • MD5

    27934061e8cbcfcf5e5b8937a662c26f

  • SHA1

    a508513b842e11c7c277af67e4bc51466d0637b8

  • SHA256

    49e7ee12a475105efab2e363450b2e5582fc05d114967fe57a3d80d22a2fea81

  • SHA512

    c79374546867ae8197d6fdbec40150b7124e272151e73c2a7361dd96a04b3a5f710d42f82b0d77349a07ae667aee066b11c949782eb2f2329e3711752e2c95d2

  • SSDEEP

    24576:q0jXiRZoEJGywbvjCe9WRSKObmSej7vydBs:MDIvjCe4ebmSejzf

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

127.0.0.1:59321

nnamoo.duckdns.org:59321

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-41EVS0

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      Quotationpdf.exe

    • Size

      869KB

    • MD5

      27934061e8cbcfcf5e5b8937a662c26f

    • SHA1

      a508513b842e11c7c277af67e4bc51466d0637b8

    • SHA256

      49e7ee12a475105efab2e363450b2e5582fc05d114967fe57a3d80d22a2fea81

    • SHA512

      c79374546867ae8197d6fdbec40150b7124e272151e73c2a7361dd96a04b3a5f710d42f82b0d77349a07ae667aee066b11c949782eb2f2329e3711752e2c95d2

    • SSDEEP

      24576:q0jXiRZoEJGywbvjCe9WRSKObmSej7vydBs:MDIvjCe4ebmSejzf

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.