Extracted

• • Target

    8c8cad5c12f471f42d5992e71bd32478aedb40af922b03ef4920047012c04d1f.exe

  • Size

    1.0MB

  • MD5

    3fcb3ba201b234234bc5d65d20afe8f4

  • SHA1

    78917404e82b3bb709ce2caa6a2c291922f1539f

  • SHA256

    8c8cad5c12f471f42d5992e71bd32478aedb40af922b03ef4920047012c04d1f

  • SHA512

    6d8e182c3386d724aa6e7d6bd266606a31db3b2f553080e03955f04c8c7f80130b67faa6c5f2d7ceb2148f6f638d97dc90296f0ae92354592562c2f1724b714a

  • SSDEEP

    24576:L8M3chivYWuMmZIAsS9IfjYf/K2VG4ei4qHAlBTbhkBNQqzcnoT:TQBvIHSfVGoxKhyNpzcnI

  Score

  10^/10

  remcosremotehostdiscoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2