Extracted

• • Target

    7815d02dd41dd657438b4b226f4ac1a33d6a37159e34448627088e1354f9ab69.exe

  • Size

    950KB

  • MD5

    b8896a4d1adbefcc7fe4cac53b134968

  • SHA1

    e7a68f4c1ac47ecc6cc43b12dc82651cff63f670

  • SHA256

    7815d02dd41dd657438b4b226f4ac1a33d6a37159e34448627088e1354f9ab69

  • SHA512

    408cca545c8556b6191629d40ac69a25a2396e90b1daa74780bf5eec62abf908413836087fb45c48205cd35acd653884fb958cecdd3a25f487b1c3b864e10e83

  • SSDEEP

    24576:1q7ngtNkKoxK5AP2EwiRcsgL5UNs3hpJB3FcU8Q:g7g7kKoKAOEF8UNYhpJ5F/8Q

  Score

  10^/10

  discoveryexecutionremcos3456789rat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2