Extracted

• • Target

    April Account Ledger_1.exe

  • Size

    574KB

  • MD5

    9b46fc395d0ba05be6a0a1860a863142

  • SHA1

    3c7419a5107c36a62bcae93ca50dea87a4836fce

  • SHA256

    8b56cc2c461f79c2cfcdbddf1dc63f021d5ccda36b9939715fd5c4f95c1d04c8

  • SHA512

    6cbe9ceaab9b30c26246e2a398152dc94744b7fb96fd5f0362729e03d511138e72f67e7229a18cc51a0bd6a806b0df265232420c9eb5c88b53ff71d33a446cda

  • SSDEEP

    12288:ZFaI3K8ZDjs2kwxUFR3mB476nJ7owK4YWnwK5Vc2nEAmD:ZTawDjhPxUF5maun6Tonw8h

  Score

  10^/10

  remcosnxtexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2