Extracted

• • Target

    BP-30M31_20240829_093844.exe

  • Size

    987KB

  • MD5

    3fd2edc9d87c0a0eb814814f8f461483

  • SHA1

    4b9ec9455439827479f661ddba252228e60db2ce

  • SHA256

    3d896c411b2b4c2f0f419adda474b192d6e7e0f496c7cf4bfb678d9bcdae11b5

  • SHA512

    21aee3b2bf388738937f7a262bc5def06c0d0eb09529d237565b369f93c643c5a44292031d844dc5a6e6a7f85866683d27e92ea966d3c24f89eabc6e84ae5070

  • SSDEEP

    24576:OZMMCpg5QbkH/njR1WWdHSZCGF9bbMZi:70QmjR1W+HGHb9

  Score

  10^/10

  remcosremotehostdiscoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2