Extracted

• • Target

    0955e1c717cfb3cc4b97d2e22f2e1f6493b6afa62f94e8d068baa3946f47f820.exe

  • Size

    932KB

  • MD5

    64e16402e0b5cb51390ae3045c20a7df

  • SHA1

    a5d496972c0344e5d72272d03daa5fcadabcc87d

  • SHA256

    0955e1c717cfb3cc4b97d2e22f2e1f6493b6afa62f94e8d068baa3946f47f820

  • SHA512

    5e2c69c2922591ee05d1d272e6acea984a8b5d9332f07629ecb3c14e06a516b61ec460b0b438f29155d995c39aa14e4c1eaa7b3233dc6fc8104a9f2f6bb197bc

  • SSDEEP

    24576:zYQactqtW214Y3PTp8au7Yf7nP0zChutXNBxRv6N:zS1d3Pl8aueEqutDxJ

  Score

  10^/10

  remcos5764576discoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2