Extracted

• • Target

    94338a235c9207ba31032496ba04d39ae887a3155c15d57347307df2dfa16242.exe

  • Size

    936KB

  • MD5

    f4aedd9c8b06bf6f30404ae4c5de18c0

  • SHA1

    9f3b3c5c600416806ca99050f0fe8428e0215720

  • SHA256

    94338a235c9207ba31032496ba04d39ae887a3155c15d57347307df2dfa16242

  • SHA512

    bb95bb409162e2eb1b4b17f52409c91ed38ac4fb695944fb88607df96279778626af650db6028d96e8bce742480ad9f3971896e08e6417712ee06a256111e39a

  • SSDEEP

    24576:Y9MC/qaSu32aV7pOsOwCWiB3F8mUlUAPrs3L0hMa2aa1ucko/8gv:riUu32I+jFvU6APA70hMaz+koX

  Score

  10^/10

  remcosaug 20c2discoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2