Extracted

• • Target

    465c79cd8303aac9888982f9edbca10aecbf7b0dca4df78d2c3a2bb429104ebf.exe

  • Size

    895KB

  • MD5

    7441688208521af2eace2cecd3872f24

  • SHA1

    4dd23aa0e9a5f340f5a1da50c272ec7047bbece1

  • SHA256

    465c79cd8303aac9888982f9edbca10aecbf7b0dca4df78d2c3a2bb429104ebf

  • SHA512

    be85c5f93a32a6fa244dbffc5dbabbfe007120065a9ed48faebc337e3e8496591d58a424d6026e8312675d476329942a60205d2349b598390b8176cd033459ce

  • SSDEEP

    24576:n2BRYbqRRw+dsXFdyA8vY+P45afP16P1f9xER:n2BRlRRxdVTIy6P1rER

  Score

  10^/10

  remcos5764576discoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2