Extracted

• • Target

    31febdf316e73eaa38c90143a5cd2351cdc4f4921ada4f6b053e5f9c2fa3d752.exe

  • Size

    908KB

  • MD5

    2fdf82bc3f069832d3599399c1387e07

  • SHA1

    189ba992552eca7c89f430d084b3b29d3a4b18b8

  • SHA256

    31febdf316e73eaa38c90143a5cd2351cdc4f4921ada4f6b053e5f9c2fa3d752

  • SHA512

    1a80c9bd3837c2f565f243d7f0bb8395642013887c1710555f3f1cdb06fea846b92871beb4e3473cdb55e0912ae76301bfef2bf5f1384cac4d02df95276f0e10

  • SSDEEP

    24576:qOGdumZu8lNib6eFUhmekfhv74ROOY3xxXBN2:qduh23eFUhm9j4EOIXv

  Score

  10^/10

  discoveryexecutionremcos3456789rat

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2