Extracted

• • Target

    f76934a541edddd96ff55c70aff0ba2be3c7f20b1b1f96a48f6ee99daeaef220.exe

  • Size

    1.5MB

  • MD5

    eb6fbf94ac91b528b6c2fef7c6dd79af

  • SHA1

    4f5079f8402b5a935cc9dcf2fd02ee98dabf95ed

  • SHA256

    f76934a541edddd96ff55c70aff0ba2be3c7f20b1b1f96a48f6ee99daeaef220

  • SHA512

    2078931c8643f000560734eec6d73b88382f16e9a5db6a48e151e0bee9cbd53f87384bd8731b248eb8e446a1cedf2041e81528fe5a73bf07a800f6b5c76696b2

  • SSDEEP

    24576:jElEJSNI3rQ9891j8F1Oo/42VuKZWaKoPDfK6Dy6pPnltz1k:QlSaI3ruUjCT/huroPVy65lh1

  Score

  10^/10

  remcosremcocoexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2