Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

78c08d27fd...96.exe

windows7-x64

3

78c08d27fd...96.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    78c08d27fdb7621e7965f2e4b06cad98071c050a9ba78a2aa4036903189a5c96.exe

  • Size

    611KB

  • Sample

    241120-h574sstgqr

  • MD5

    8648d43adefb6508a273f31396b042c3

  • SHA1

    6decae9e6458caec0acc9b0111d518ed3dbe2768

  • SHA256

    78c08d27fdb7621e7965f2e4b06cad98071c050a9ba78a2aa4036903189a5c96

  • SHA512

    9fe2ba142c3f3af5e8b69d5c823a6de9de5a385a5feeed398ae16d3056f826f331f0684ab2088be858f4710f403ec73f241d44e171ed63477f4f435605d2dd92

  • SSDEEP

    12288:8zBB2EzqBTMudgkVJnQb7WvpQOSSQNx6qZ5l:aB2EzqBIudgkTQb7Wu58i5l

Score
10/10
remcosremotehostdiscoveryrat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

162.251.122.76:7119

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-P2SX34

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      78c08d27fdb7621e7965f2e4b06cad98071c050a9ba78a2aa4036903189a5c96.exe

    • Size

      611KB

    • MD5

      8648d43adefb6508a273f31396b042c3

    • SHA1

      6decae9e6458caec0acc9b0111d518ed3dbe2768

    • SHA256

      78c08d27fdb7621e7965f2e4b06cad98071c050a9ba78a2aa4036903189a5c96

    • SHA512

      9fe2ba142c3f3af5e8b69d5c823a6de9de5a385a5feeed398ae16d3056f826f331f0684ab2088be858f4710f403ec73f241d44e171ed63477f4f435605d2dd92

    • SSDEEP

      12288:8zBB2EzqBTMudgkVJnQb7WvpQOSSQNx6qZ5l:aB2EzqBIudgkTQb7Wu58i5l

    Score
    10/10
    discoveryremcosremotehostrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.