Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

1F1A21095F...C8.exe

windows7-x64

1

1F1A21095F...C8.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1F1A21095F21BEB7AF3B85FFEDBB79C8.exe

  • Size

    487KB

  • MD5

    1f1a21095f21beb7af3b85ffedbb79c8

  • SHA1

    5c0edfe6960eecc647fa32c770b8f8dfb104fb4f

  • SHA256

    d3f6851a2a0d067d918b81b1538405e179e8c59a5d1ab658c30092452d927e2b

  • SHA512

    fb6d74a11a60eb50056de665c2ec1875b2a108bfcd08ff2c8a2d4b78ca95d92813cfde6c910660e8097f6cdc3ce28c6a2da44a87fbe00bb00c2df912a4522f8b

  • SSDEEP

    12288:CuD09AUkNIGBYYv4eK13x13nZHSRVMf139F5wIB7+IwtHwBtVxbesvZ6Qz+DYS:B09AfNIEYsunZvZ19Zfsp

Score
10/10
28086remcos

Malware Config

Extracted

Family

remcos

Botnet

28086

C2

5.45.79.50:28086

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    &^%GB7e-C4HPBG

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos family
    remcos
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1F1A21095F21BEB7AF3B85FFEDBB79C8.exe
    .exe windows:5 windows x86 arch:x86

    e77512f955eaf60ccff45e02d69234de


    Headers

    Imports

    Sections

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.