Extracted

• • Target

    869d82f75b419b649177813ee10ff71987aa775e0c86868bb952aab22f6fe91d.exe

  • Size

    604KB

  • MD5

    ffc880a6448b251eee7f03809bf0a1bf

  • SHA1

    09e75e38d588b0e99a3f6f85b2dc4a3eebe4ee08

  • SHA256

    869d82f75b419b649177813ee10ff71987aa775e0c86868bb952aab22f6fe91d

  • SHA512

    21dbc92495d2afa76e2e0b7243586ce70889e6cf1240222f1c75aab217df9a0287f9b9b5f3c754011ecfec411c2677c3fd091bcb2b620205c2c97db564b7b180

  • SSDEEP

    12288:O+DbgZB778Qed59T3C6g9XltKMYicJgTx5bx4OVEIHDe2RZQioKEAmD:3gZBS9TbgoMpcJ+Tbe7Ye2nOK

  Score

  10^/10

  remcosnhsexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • detects Windows exceutables potentially bypassing UAC using eventvwr.exe

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2