Extracted

• • Target

    26b72c81c3128373635fb99afe3e28b5c17a069dbe828229243b3484960521f6.exe

  • Size

    1.0MB

  • MD5

    3e8c08e25ead11c971b7d6d0c6992d8b

  • SHA1

    c9f3bd9dc092463a405967b7c9237522f3db0a94

  • SHA256

    26b72c81c3128373635fb99afe3e28b5c17a069dbe828229243b3484960521f6

  • SHA512

    0d9b74577c90530af134b86b2669968a39c8bf0885826021d8f6fe228e8a66974f1df929b4940f4a5ff8b024554f6bdf40e6559670204f876a0f074de5300598

  • SSDEEP

    24576:N+1bAypceDrbuuMGsMc2DOqqwrEKUfZlEq+HLUUz4:0VOeDrCpfMZSZfjfZqq+o/

  Score

  10^/10

  discoveryremcos5764576executionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2