Extracted

• • Target

    8fb486798392dbf7aeeae64d1338d5be840b88b9be64e271c83010039a96b5bf.exe

  • Size

    887KB

  • MD5

    4f17996e37a6f17855f4d99a3952e758

  • SHA1

    a32236cca26fa4d3eb8b2a322f41c22f5aef5f1d

  • SHA256

    8fb486798392dbf7aeeae64d1338d5be840b88b9be64e271c83010039a96b5bf

  • SHA512

    1990ae9e17c1a78207b5588a2520676e8304f7cd431362eb5a50beb64d4ce3dc60f4e37fe874370f23199ddfe91e72801ed257a9edccbd6cfc8a3f3418c24c74

  • SSDEEP

    12288:ZMdcDNLv2uxySCenLFFwcUXLneC8I87rFmfDJUnt2LzcNI0jJnDN8LojGByXH6:DDZEStLDwcUbeCJ3MI0L8KGg

  Score

  10^/10

  remcosremotehostdiscoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2