Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

a70404d3f9...78.exe

windows7-x64

10

a70404d3f9...78.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a70404d3f9f9fc5e48ac266731e1b3b5a780ae9b0ba15e865418e5f908aa6178.exe

  • Size

    899KB

  • Sample

    241119-fwh27s1fql

  • MD5

    410076dd0a643306b7991a32d9580143

  • SHA1

    7c40be225169cf017cbdfe52ba8225b836dacf4c

  • SHA256

    a70404d3f9f9fc5e48ac266731e1b3b5a780ae9b0ba15e865418e5f908aa6178

  • SHA512

    22ddfe95a188974b1b492c75f4c03d53a5668b52be1520a5cc5fb13915c346ca8485bc5b0678f47e0ad51acf1c4dcd0ffb711605821a5229cafcf07bdc338190

  • SSDEEP

    24576:lHIQsBmLOmrolDJO1Y6xMgKlfizJxQxSAKwe3GO80g:CQsBMOmrwCoZitYSApkGh0g

Score
10/10
remcoshostdiscoveryrat

Malware Config

Extracted

Family

remcos

Botnet

Host

C2

oyo.work.gd:3142

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    vlc

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    pdf

  • mouse_option

    false

  • mutex

    jkm-I9KENP

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    ios

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      a70404d3f9f9fc5e48ac266731e1b3b5a780ae9b0ba15e865418e5f908aa6178.exe

    • Size

      899KB

    • MD5

      410076dd0a643306b7991a32d9580143

    • SHA1

      7c40be225169cf017cbdfe52ba8225b836dacf4c

    • SHA256

      a70404d3f9f9fc5e48ac266731e1b3b5a780ae9b0ba15e865418e5f908aa6178

    • SHA512

      22ddfe95a188974b1b492c75f4c03d53a5668b52be1520a5cc5fb13915c346ca8485bc5b0678f47e0ad51acf1c4dcd0ffb711605821a5229cafcf07bdc338190

    • SSDEEP

      24576:lHIQsBmLOmrolDJO1Y6xMgKlfizJxQxSAKwe3GO80g:CQsBMOmrwCoZitYSApkGh0g

    Score
    10/10
    remcoshostdiscoveryrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.