Extracted

• • Target

    f34fd6a0b6536f074e3a1bc41f0e35a80667688de9668cd1d75f6920a06e7607.exe

  • Size

    970KB

  • MD5

    4b487f91d2504883b4c9df18848af5ef

  • SHA1

    964e913b8b4cba2232e46b3fe0b73b1c009bed7d

  • SHA256

    f34fd6a0b6536f074e3a1bc41f0e35a80667688de9668cd1d75f6920a06e7607

  • SHA512

    2f38dfa36bff6235dcddb359af65e3374f556e40fd950c6e5e9b52a474d46227d833fd9897efc925b781f6b97b093b29dc9d119edc88d76a23d3407a1471e23b

  • SSDEEP

    24576:BYx8QzPlMGKwlyvxR27CYOlOLkgggD8lyftUCp2mv:6x8QzZYvxR2WbRggp0XT

  Score

  10^/10

  remcosh�textediscoveryexecutionpersistencerat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2