Extracted

• • Target

    b3c084f9fd5fe18129978cccf6d2d2ac972d5c7db3a7378372476f535cc16b8e.exe

  • Size

    863KB

  • MD5

    1c2a46d46812b1424ad44ac59b4c8d9a

  • SHA1

    ad2822fc0804fad19c1d959f02c0011d80a7ab4c

  • SHA256

    b3c084f9fd5fe18129978cccf6d2d2ac972d5c7db3a7378372476f535cc16b8e

  • SHA512

    0e3107208813adb9ca79720bea24dcc333bff9c7bc084b31a7abc92ecb1d09ed7deffe9014d0b85f4154aad6499d626eec85e0f43c570954afd437151219bc39

  • SSDEEP

    24576:D1YaXjYr93cjbHRtEmWHs7FK5WQSDndP:D13MrhcjbHRWmh7c5MDdP

  Score

  10^/10

  discoveryexecutionremcos3456789rat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2