Extracted

• • Target

    ee4e163f38aca1399baa166ca87561d0N.exe

  • Size

    1.0MB

  • MD5

    ee4e163f38aca1399baa166ca87561d0

  • SHA1

    950960b4606eb30402e53415d30d6591fa92fde9

  • SHA256

    9e6875db397f7d76fcae09d39360a73237b11b1fbfcfa7275bb7fe7cf0d87df8

  • SHA512

    9e121dee4f9f1acc8ca9169ea4161a7654c849cc04b40baa93c24b20003f511c96ff369e9f3913305e3f230de935d8ff3ea522c12e14b71153c50d6113f425dd

  • SSDEEP

    24576:0HH6h1OoaYANm0loL58KwewFARcqlE3r9HMQKN:k8t0loL58KwLgQ7lMQKN

  Score

  10^/10

  discoveryexecutionremcosaug 19.2rat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2