Extracted

• • Target

    Al Yasmeen Electrical Switchgear & Trading LLC.exe

  • Size

    998KB

  • MD5

    f31ce3bf8391b1edbaea438c1920af56

  • SHA1

    465e13229ab8413967c081ae388f53f63b8789d0

  • SHA256

    5e348f263074a2c36ce3bcdf930404af01f327157b1494ac154e4f13044833d1

  • SHA512

    279d5ecfd6e047f984677c6bdb920131c0e54179948040c97af8481113d99cd3813cc88ed5eafa6f5e97a8a4d67a412ed89e131c91338d0b64caf6ef8c9abbce

  • SSDEEP

    24576:BXxaakbHiqKTT+xSZEbLxszls1FHO2gDMMF0DSqUC9QCA:XCmLabu4FHO2gDoDCC

  Score

  10^/10

  remcosremotehostdiscoveryexecutionpersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2