Extracted

• • Target

    73d157aceb0cbefa3a24509f157e8b59c40881acd0e3360d026fee5845e19f2c.exe

  • Size

    962KB

  • MD5

    094a5d7931f64c66d76b0fe5cc728262

  • SHA1

    4a3cbbe7590ab3e7cd3c40fc62558aaaa251a3e8

  • SHA256

    73d157aceb0cbefa3a24509f157e8b59c40881acd0e3360d026fee5845e19f2c

  • SHA512

    c2b31f3aca35b2e048e1fa10a6f8ed972097651a0fb85be675e0b7ea8765e04ba7b1f68be8c5bef25f919dff56c49b139e5d1ef4cad4c472ed0dc281ee4905aa

  • SSDEEP

    12288:AfOzlAPrLGY72HiM2AUpGNSfIKsAW1Nunhe2z8JBvR1unEhyDsRiWnze6EzyskDF:AfglYKG2Kwb3unMLBvh8sRdS6rd8Qt

  Score

  10^/10

  remcosremotehostdiscoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2