Extracted

• • Target

    a3b8b22001bd2cdb7235143b52225c2063d33b63a87e44cba0dae647c49be7ce

  • Size

    903KB

  • MD5

    51f72049f9a159ebe2d0703fa2e9e898

  • SHA1

    8c85bdf7ceff32613cf219da176808ad8a8a8b99

  • SHA256

    a3b8b22001bd2cdb7235143b52225c2063d33b63a87e44cba0dae647c49be7ce

  • SHA512

    fb690d21a2a4a7167c9cf6932a20772db4431bff831e9aafbf502913cd84523f99a002a6ae88383d2cfe6b80e89242ebf8448b1ef563bfce322edb0afc42e168

  • SSDEEP

    24576:RUN2k1xt4uIDiHiNan2k95YYzBQak2P44b3i64I+xrST9i:RU8MfI8uan2kPTz7p9b5VTk

  Score

  10^/10

  remcosrhymerdiscoveryexecutionrat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2