Extracted

• • Target

    33cc55fef11d691d7728275b1e7dfc61520cef61bb0035de7dfb8e648f086f50.exe

  • Size

    610KB

  • MD5

    a83c7c19a689b683942bf29ebcc82e07

  • SHA1

    535cdf86f5c064932fea71d169ba1c9e3acf4886

  • SHA256

    33cc55fef11d691d7728275b1e7dfc61520cef61bb0035de7dfb8e648f086f50

  • SHA512

    58cf11e78fcd01715e1ce9b0877b601d56f95681bc82986e0d7fc6d58a8a9169e28fa46a134bed1000672bd52fe7b2c291fff4bb3fe540d18ec240204bad1881

  • SSDEEP

    12288:y0pei36RatdHmBK2h+RrUm1jkHui7jkNAMo6WDNGn7cX0O2eEAmD:Vpp36stJqDwRrp6Z7P6uGn4kO2e

  Score

  10^/10

  executionremcosbanksyrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • detects Windows exceutables potentially bypassing UAC using eventvwr.exe

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2