Extracted

• • Target

    53893a8c0f205e7f0c96f045a6f7bce683bde52b4a692fc64075f863cd8f3c3d

  • Size

    1.1MB

  • MD5

    77e3e093c61c0e2ca41f47a470e74f31

  • SHA1

    c1de740d11d19016caa74c6667b63d85bb765a9f

  • SHA256

    53893a8c0f205e7f0c96f045a6f7bce683bde52b4a692fc64075f863cd8f3c3d

  • SHA512

    fe88fc3a873b33e0f3838f5d9067e1166d8b735e2a596f5a166be47bfc6b9fdf002faf459bc088ea11c35c826aff6c0eacc0e560894ee08451d9828a38b99a8f

  • SSDEEP

    24576:XIGqgFOl3M0XmHxT+3A2U8REKt6csqfa+d+Dih:FFOSDt+QuWKvswjX

  Score

  10^/10

  remcosaquafinaexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2