Extracted

• • Target

    e0d74fa44286f3a4c4c4c2fc151a339f487c2af644fb9691016dcf057b3bd343.exe

  • Size

    1.1MB

  • MD5

    a4df734fada4dec0bebcbbbed4e083ab

  • SHA1

    283763090c6af71ef60d76b4515c9edebd416bcf

  • SHA256

    e0d74fa44286f3a4c4c4c2fc151a339f487c2af644fb9691016dcf057b3bd343

  • SHA512

    914b580fefa91d948a256c2f2ab39b18f36f631e7ff9c387888334521221466814af45bde59b59420c8eb6f22d0808afc6e27f3b562d5c495ab8b8a7666af637

  • SSDEEP

    24576:bOp3fxqwcD01FUKer5zdzDarNhrBAJhDdiGXck5WZ7XZeLBmWlo:bOZOqbeDsBixy7XZsblo

  Score

  10^/10

  remcos76364executionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • detects Windows exceutables potentially bypassing UAC using eventvwr.exe

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2