Extracted

• • Target

    6fb1afbb72d328bdaca9c019107c5ce12c81bfbabac1f1b7426db29ffec79f96.exe

  • Size

    914KB

  • MD5

    57c246dd2b2221edbfd54ff9246a0099

  • SHA1

    3e4dc6e19407ff041b25629082a90382be7b957f

  • SHA256

    6fb1afbb72d328bdaca9c019107c5ce12c81bfbabac1f1b7426db29ffec79f96

  • SHA512

    5a49e14dfaa8b6f53bc9e5da299f43d199389ded897c9a23ec6615c396bc83e6589787f0704fa097c395296d643fd0b6b3e83dbdddad385d2ee5af5825cea9e2

  • SSDEEP

    24576:+Eb5NCjPBS2nv0frerFWM+u848EUjooYgyUKHdw:N5N+5S2nv0fKxIuRUjoSK

  Score

  10^/10

  discoveryexecutionremcosthrottle_8967rat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2