Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

50f5c3328a...f2.exe

windows7-x64

3

50f5c3328a...f2.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    50f5c3328ae851557ff5655153cd13fbe61221363a7396b000d21b16fede1af2.exe

  • Size

    481KB

  • MD5

    4ffe2f23062e26a4da02ec2d0cb40a4f

  • SHA1

    30ab6acf645a904d3b600308a021c007b9ddbec5

  • SHA256

    50f5c3328ae851557ff5655153cd13fbe61221363a7396b000d21b16fede1af2

  • SHA512

    ab37b6bff84a5bc1acabe66ccf8e732aecdbb2e50982a3d47891a13848d10dc997f6554702529f4eeac4929499e007d9060d40d9bbed3b8bc8b89f5549d25335

  • SSDEEP

    12288:tuD09AUkNIGBYYv4eK13x13nZHSRVMf139F5wIB7+IwtHwBtVxbesvZDSto+DY:g09AfNIEYsunZvZ19ZBs

Score
10/10
fulanoremcos

Malware Config

Extracted

Family

remcos

Botnet

fulano

C2

probandonuevodomicolombia.cfd:3020

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    registros.dat

  • keylog_flag

    false

  • keylog_folder

    registros

  • mouse_option

    false

  • mutex

    lkjbdfjkbkjmbnnvnmcnm-MJPIRV

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Capturas de pantalla

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos family
    remcos
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 50f5c3328ae851557ff5655153cd13fbe61221363a7396b000d21b16fede1af2.exe
    .exe windows:5 windows x86 arch:x86

    e77512f955eaf60ccff45e02d69234de


    Headers

    Imports

    Sections

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.