Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
6a6bdca6653405f741177f8f141bf3231ba7e17c14da81a1d8286803ed866d18
-
Size
1.4MB
-
Sample
241113-cawjmaxpdn
-
MD5
43606bda84564bc8850173573be00a16
-
SHA1
40b066639b0b59e892ceac671c263b436544406b
-
SHA256
6a6bdca6653405f741177f8f141bf3231ba7e17c14da81a1d8286803ed866d18
-
SHA512
f91ff9228d79801f7636833334eb7b6d4bd979a9888df8e624af4a591cda1adb4c6ff8b2145ba4a721ef7c538dc54f195a4fc697d686403cc04272849235828e
-
SSDEEP
24576:0zFh6Ax5KkdYBlFJq3S+QxraaBEhK3ZDsncGI0qBttv9/NkmMJjr2H:wFh6MKkWVJq3ZuhBEhMgcAmvR0YH
Static task
static1
Behavioral task
behavioral1
Sample
RFQ_HYU-241002863 SQ-242000846그리고 PO-248000263.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
RFQ_HYU-241002863 SQ-242000846그리고 PO-248000263.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
remcos
RemoteHost
162.251.122.86:6644
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-CGA6IQ
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
RFQ_HYU-241002863 SQ-242000846그리고 PO-248000263.exe
-
Size
1.7MB
-
MD5
1d572147e37c4766851afec9c30aacf9
-
SHA1
cee9e2191859ccbbb259329684bd1849056a3622
-
SHA256
6177136bd2ab5a59885aed70a333b5b59885bc9457bd36a98f176f6d26c8b530
-
SHA512
24f30d63ff61f729af2f84558b5f42778921be921706e182cbf58aa12637c44bc3967ec8e29583924791724b1af54db697a22bea4b8a02bede1cb21ed9f453c5
-
SSDEEP
49152:7JZoQrbTFZY1iaC3q3z8JFExUq4IoBNA13:7trbTA1Xz8EPTx13
-
Remcos family
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook accounts
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-