Extracted

• • Target

    b1801e102f5cb5dce9e2628bd80932a39bd57ff68d32c824ad4443f7bd00ea2d.exe

  • Size

    1.0MB

  • MD5

    c0a2a67a65ca2de4bafa5b8d5aee0527

  • SHA1

    db59b429d52a174f285bca3e648da12ce14e8eaa

  • SHA256

    b1801e102f5cb5dce9e2628bd80932a39bd57ff68d32c824ad4443f7bd00ea2d

  • SHA512

    ad7d436b3bef3aaa20dfb0cb8c904cf5fa0702360900bb9d0c747c49ab3d36c6bcb56d9daa39218b4f2326421f5ee1eb015daa4a92755cba5d6f9ee94492559b

  • SSDEEP

    24576:ZvlIJSNI0eOcZdrQrJF3kkR82WkaiX3BZW9ngnFCDAcNep:pleaIi4QrWka2jXn/Z

  Score

  10^/10

  remcos76364executionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • detects Windows exceutables potentially bypassing UAC using eventvwr.exe

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2