Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

c9564d106a...31.exe

windows7-x64

9

c9564d106a...31.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c9564d106a547ddcaf51d056ed08878445a9b43e0779c19c20f851705a1ea331

  • Size

    484KB

  • MD5

    cdde6ac5623788eef4ff12d93323ba54

  • SHA1

    5ab4c6b83c308e73a5b5429f15dcb72fc8480c16

  • SHA256

    c9564d106a547ddcaf51d056ed08878445a9b43e0779c19c20f851705a1ea331

  • SHA512

    14475df4de76cd81f4a330a5b041ed1bae3d3bca6a3b28f13b50e26486ffa0242b1172ca724574c87a497e7af58b2f953c39813d81e5857c8da3a4b2cda000dd

  • SSDEEP

    12288:duD09AUkNIGBYYv4eK13x13nZHSRVMf139F5wIB7+IwtHwBtVxbesvZ2Xi+DYT:Q09AfNIEYsunZvZ19ZTs8

Score
10/10
remotehostremcos

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

185.42.12.39:2404

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    negrila

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    negrila-U1ITV4

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos family
    remcos
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • c9564d106a547ddcaf51d056ed08878445a9b43e0779c19c20f851705a1ea331
    .exe windows:5 windows x86 arch:x86

    e77512f955eaf60ccff45e02d69234de


    Headers

    Imports

    Sections

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.