Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

586f683570...f7.exe

windows7-x64

3

586f683570...f7.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    586f683570e1dee78b376a2feeaf0e73f04a668ce82f0fe765eff566b3887af7

  • Size

    483KB

  • MD5

    f080e8592d9fd9f4a41c389af2071dc6

  • SHA1

    352f0286ccc2c4cdabe54092239b2f600d34c898

  • SHA256

    586f683570e1dee78b376a2feeaf0e73f04a668ce82f0fe765eff566b3887af7

  • SHA512

    35d97a99f74dfa33afe37bcd04fc5f4de6c38eb163b9fa84a20d0b2a507276b7abb27a4abe0caba0ce8c929ef238d554913465509f971d2246dab23c5e66498c

  • SSDEEP

    12288:W5k+Yqaxrh3Nln+N52fIA4jbsvZzGyA4:gY9xrh3NDfIA4jOZ

Score
10/10
remotehost-16465remcos

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost-16465

C2

rem.aaahorneswll.com:16465

31.13.224.230:16465
Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-80V4Z7

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos family
    remcos
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 586f683570e1dee78b376a2feeaf0e73f04a668ce82f0fe765eff566b3887af7
    .exe windows:5 windows x86 arch:x86

    1389569a3a39186f3eb453b501cfe688


    Headers

    Imports

    Sections

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.