Extracted

• • Target

    DHL SHIPPING DOC 5596370080.exe

  • Size

    1000KB

  • MD5

    56729ceff54040279ee91421f81b2eb6

  • SHA1

    4bff52933e1beb10ca9b24f4ca520824f7dd4d43

  • SHA256

    effb59e562e566570fbd4dc5df959dd14ad9f0a181b65189644fdfe9425692a4

  • SHA512

    d6a558125bd4a4055e1abb6646b522ed96eef9b58890d64dd9e64a5974121dc1c5a76357c588be7bb89ca53a439946593e044bf9ce692944f8c99e7f0c9723f1

  • SSDEEP

    24576:u9jH3DIiUsayYAATnSy8phsWX73hdQByIdq7ZIBrE24BvGxtP:oP1wRA8o+I4fKZid4c/P

  Score

  10^/10

  remcos76364executionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2