Extracted

• • Target

    4e4855563c47f7a6c230b54ef27c2e1d46f6d895220588d5ba50652414de98e2.exe

  • Size

    927KB

  • MD5

    18416919737cea3ac328aa30560e3be4

  • SHA1

    c446f65f62326e534c1627af9d836e58d28d88d5

  • SHA256

    4e4855563c47f7a6c230b54ef27c2e1d46f6d895220588d5ba50652414de98e2

  • SHA512

    f53d846d4507541113feb3244acd9c66e1649d29f3c1331c30d8bd7cd5f478482a7313882b5d191e037d1592d695c3d85522272a6d0f816ca8f63e177ce870a8

  • SSDEEP

    24576:W0HPaXjcpYXYrq05AuW7FzuT8udqrPvVmiN0nL:BaTi/xksbdq3Ei0n

  Score

  10^/10

  remcosremotehostexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Detects executables packed with SmartAssembly

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2